CVE-2022-39987

Vulnerability

Overview

CVE-2022-39987 is a command injection vulnerability in RaspAP versions 2.8.0 through 2.9.2, a popular web-based wireless router management interface for Debian-based devices [1]. The flaw exists in the /ajax/networking/get_wgkey.php endpoint, where the entity POST parameter is passed unsanitized to a system shell. This allows an attacker who has already authenticated to the RaspAP web interface to inject arbitrary OS commands [3].

Attack

Vector & Prerequisites

Exploitation requires prior authentication to the RaspAP web panel, which is typically protected by a login form. Once authenticated, an attacker can send a crafted HTTP POST request to get_wgkey.php containing malicious shell metacharacters in the entity parameter [2]. The application does not filter or escape the input before incorporating it into a shell command, leading to injection.

Impact & Scope

Because the vulnerable script runs with root privileges (common for networking-related functionality in RaspAP), a successful injection gives the attacker full control over the underlying operating system. This can be leveraged to install persistent backdoors, exfiltrate data, pivot to other hosts on the network, or disrupt services. The attack is network-based and does not require direct physical access beyond network connectivity to the RaspAP management interface.

Remediation

The vulnerability has been patched in commit e87e7d1d by sanitizing the entity parameter with escapeshellcmd() [4]. Users are strongly advised to upgrade to RaspAP version 2.9.3 or later, which includes this fix [2]. There is no workaround short of upgrading, as the vulnerable code path is essential for WireGuard key management functionality. If an upgrade is not immediately possible, restricting network access to the RaspAP web interface and monitoring for unexpected administrative logins may reduce risk.