CVE-2022-44384

Vulnerability

An arbitrary file upload vulnerability exists in rConfig v3.9.6 (and possibly earlier versions). The bug resides in the device backup functionality, where the application fails to properly validate the file type of uploaded files. An authenticated attacker can upload a file with a .php extension, which is then stored in a web-accessible directory and can be executed by the server [1].

Exploitation

To exploit this vulnerability, an attacker must have valid credentials for the rConfig web interface (i.e., the attacker must be authenticated). The exploit is carried out by sending a crafted HTTP POST request to the vulnerable endpoint, typically commands.inc.php, with the malicious PHP file included in the request payload. The file is saved to a path such as /home/rconfig/public_html/rconfig/commands/ and can then be accessed via a separate HTTP request to trigger execution [1].

Impact

Successful exploitation allows the attacker to achieve remote code execution on the underlying server with the privileges of the web server user (typically www-data). This enables full compromise of the rConfig application and, depending on server configuration, potential lateral movement within the network. The attacker can execute arbitrary system commands, read, write, or delete files, and install further malware [1].

Mitigation

As of the publication date of this CVE (2022-11-17), no official patch or updated version has been released by rConfig to address this vulnerability. Users are advised to restrict access to the rConfig web interface to trusted networks only and to implement strong authentication and file upload validation controls. The vulnerability is listed in the Exploit Database as EDB-ID 49783, indicating that exploit code is publicly available. Organizations should consider upgrading to a secure alternative if rConfig does not provide a fix [1].