CVE-2022-39986

A command injection vulnerability, CVE-2022-39986, exists in RaspAP versions 2.8.0 through 2.8.7. The flaw is located in the cfg_id parameter of the /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php scripts [2]. The application fails to sanitize user-supplied input before passing it to a shell command, allowing an attacker to inject arbitrary operating system commands [3].

The vulnerability is exploitable by an unauthenticated attacker over the network. No authentication is required, and the attacker does not need any prior access or privileges on the target system [2]. An attacker can craft a malicious HTTP request containing specially crafted input in the cfg_id parameter, which is then processed by the vulnerable PHP scripts, leading to command injection [4].

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the web server user (typically www-data) [2]. This can lead to full compromise of the RaspAP device, including data exfiltration, installation of malware, or use of the device as a pivot point for further attacks within the network.

The RaspAP project addressed this vulnerability in a later release by sanitizing input with escapeshellcmd() and updating the affected files [3]. Users are strongly advised to upgrade to a version higher than 2.8.7 immediately. If an upgrade is not possible, restricting network access to the RaspAP web interface and monitoring for anomalous cfg_id values are recommended interim mitigations.