RaspAP raspap-webgui HTTP POST Request provider.php code injection

Vulnerability

Overview

CVE-2024-2497 is a critical code injection vulnerability in RaspAP raspap-webgui version 3.0.9. The flaw resides in the includes/provider.php file, specifically within the HTTP POST request handler. By manipulating the country argument, an attacker can inject arbitrary code. The root cause is insufficient sanitization of user-supplied input before it is processed [2].

Exploitation

The attack is remotely exploitable without authentication. An attacker sends a crafted HTTP POST request to the vulnerable endpoint, supplying malicious payloads in the country parameter. No special network position is required beyond reachability of the RaspAP web interface. The exploit has been publicly disclosed, increasing the risk of widespread use [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the target device, typically with the privileges of the web server (e.g., www-data). This can lead to full compromise of the router, including data exfiltration, installation of backdoors, or disruption of network services. Given RaspAP's role as a wireless router management platform, the impact on affected Debian-based devices (including Raspberry Pi) is severe [1][2].

Mitigation

As of the publication date, the vendor has not responded to disclosure and no patch is available. Users are advised to restrict network access to the RaspAP web interface, use firewall rules, or consider alternative software. The vulnerability is listed with VDB-256919 and is considered critical (CVSS 4.0 not yet assigned by NVD) [2].