Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection

Vulnerability

A command injection vulnerability exists in the Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw resides in the setOpenVpnCertGenerationCfg function within the file /cgi-bin/cstecgi.cgi. The function reads the user-supplied servername parameter and, instead of sanitizing it, passes the value into a string that is subsequently executed by the CsteSystem function via execv(). This allows an attacker to inject arbitrary OS commands through the servername argument [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. The request must include a JSON payload with the topicurl set to setOpenVpnCertGenerationCfg and the servername parameter containing the desired command enclosed in backticks. No authentication is required, as the PoC demonstrates successful execution with a session cookie that may be obtained from a default session. For example, setting servername to ` ls>./setOpenVpnCertGenerationCfg.txt results in the ls` command being executed and its output written to a file [1].

Impact

Successful exploitation grants the attacker arbitrary OS command execution with the privileges of the web server process, typically root. This can lead to full compromise of the router, including data exfiltration, installation of malware, modification of device configuration, and use of the device as a pivot point for further network attacks [1].

Mitigation

As of the publication date, no official firmware update or patch has been released by Totolink to address this vulnerability. Users are advised to restrict remote access to the router's web management interface to trusted networks only, and to monitor for any suspicious activity. If possible, disable the web management interface or place the device behind a firewall until a fix is available [1].