CVE-2023-30260

Vulnerability

Overview

CVE-2023-30260 is a command injection vulnerability in the RaspAP web interface (versions 2.8.8 and earlier). The root cause is the lack of sanitization of user-supplied input in the hostapd_conf endpoint. Specifically, the interface and txpower POST parameters are passed directly to the exec() function in hostapd.php without escaping, allowing an attacker to inject arbitrary OS commands [4].

Exploitation

An attacker must first obtain valid credentials for the RaspAP web interface (the default credentials are admin:secret). With these, they can send a crafted POST request to /hostapd_conf containing a malicious payload in the interface parameter. The request must include a valid CSRF token, which can be easily extracted from the page source. The injected command is then executed with the privileges of the web server (www-data) [4].

Impact

Successful exploitation grants the attacker arbitrary command execution as www-data. In the default RaspAP configuration, this can be escalated to root privileges by abusing sudo permissions. For example, the attacker can overwrite the OpenVPN client configuration to include a malicious script that runs with root privileges when an OpenVPN connection is established [4].

Mitigation

The vulnerability has been addressed in later versions of RaspAP. The fix involves sanitizing the interface and txpower parameters and using PHP's escapeshellarg() before passing them to exec(). This was implemented in pull request #1322 [2]. Users are strongly advised to update to a patched version or apply the sanitization manually if running an older release.