Milesight UR32L vtysh_ubus tcpdump_start_cb OS command injection vulnerability

# Talos Vulnerability Report

### TALOS-2023-1714

## Milesight UR32L vtysh_ubus tcpdump_start_cb OS command injection vulnerability

##### July 6, 2023

##### CVE Number

CVE-2023-22653

##### SUMMARY

An OS command injection vulnerability exists in the vtysh_ubus tcpdump_start_cb functionality of Milesight UR32L v32.3.0.5. A specially crafted HTTP request can lead to command execution. An attacker can send an HTTP request to trigger this vulnerability.

##### CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Milesight UR32L v32.3.0.5

##### PRODUCT URLS

UR32L –

##### CVSSv3 SCORE

8.8 – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

##### CWE

CWE-78 – Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

##### DETAILS

The Milesight UR32L is an industrial cellular router. The router features include support for multiple VPNs, a router console shell, firewall and many others.

The Milesight router offers several functionalities through the `/cgi` endpoint. The “core” functionality we are considering is called `yruo_tools`. In this “core” there is one function called “tcpdump_start”. This API is used to execute the command “tcpdump” using the provided data, following the `vtysh_ubus`’s `tcpdump_start_cb` function, responsible for managing the “tcpdump_start” functionality:

void tcpdump_start_cb(undefined4 param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
undefined4 *param_5)

{
[… variable declaration …]

[… variable initialization …]
[…]
if ((param_advanced == (blob_attr *)0x0) ||
(advanced_value = (char *)blobmsg_get_string(param_advanced), *advanced == ”)) {
[…]
interface_value = (char *)blobmsg_get_string(param_interface]);
[…]
strncpy(interface_ptr,interface_value,0x80);
snprintf(last_param.interface,0x80,”%s”,interface_ptr);
is_equal = strcmp(interface_ptr,”Any”);
if (is_equal == 0) {
interface_ptr = “any”;
interface_ptr_dup = zstrdup(1,interface_ptr);
}
else {
interface_ptr_dup = if_name_display2ori(interface_ptr);
[…]
}
snprintf(tcpdump_options_string,0x100,”-i %s”,interface_ptr_dup);
[…]
if (0 &1 &”,”/usr/sbin/webtools.sh”,”tcpdump”
,tcpdump_options_string,dest_location,”/tmp/webtcpdump.lock”); [4]
[…]
system(shell_command); [5]
[…]
}

This function parses, at most, four possible params: “interface”, “ip”, “port” and “advanced”. If the “advanced” param is present and not empty, the other three are ignored. Otherwise, if the “advanced” param is not present or its value is empty, then the function will parse the “interface”, “ip” and “port”.

Eventually the code at `[4]` is reached and the string `’/usr/sbin/webtools.sh tcpdump “” “dest_location” “/tmp/webtcpdump.lock” 2>&1 &’` is composed. The `tcpdump_options_string` is composed using the provided parameters. For instance, at `[1]` is appended the `’ port ‘` string, and at `[2]` the `’ host ‘` or `’ and host ‘` is appended, based on the presence of the “port” parameter. Otherwise, if the “advanced” parameter is present, neither `[1]` or `[2]` are reached, but instead the code at `[3]` is executed.

Following are two example of commands that will result in the same composed string:

{
“id”:60,
“execute”:1,
“core”:”yruo_tools”,
“function”:”tcpdump_start”,
“values”:[
{
“interface”:”Any”,
“ip”:”192.168.0.100″,
“port”:12345,
“advanced”:””
}
]
} The above command uses the “interface”, “ip” and “port” params.

{
“id”:60,
“execute”:1,
“core”:”yruo_tools”,
“function”:”tcpdump_start”,
“values”:[
{
“interface”:””,
“ip”:””,
“port”:””,
“advanced”:”-i any port 12345 and host 192.168.0.100″
}
]
} The above command uses only the “advanced” param.

Eventually the string composed at `[4]` will be used as argument of the `system` function at `[5]`. No particular checks are performed against the parameters provided, which can lead to an OS command injection.

##### VENDOR RESPONSE

Since the maintainer of this software did not release a patch during the 90 day window specified in our policy, we have now decided to release the information regarding this vulnerability, to make users of the software aware of this problem. See Cisco’s Coordinated Vulnerability Disclosure Policy for more information: https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html

##### TIMELINE

2023-02-14 – Initial Vendor Contact
2023-02-21 – Vendor Disclosure
2023-07-06 – Public Release

##### Credit

Discovered by Francesco Benvenuto of Cisco Talos.

* * *

Vulnerability Reports Next Report

TALOS-2023-1715

Previous Report

TALOS-2023-1716Read More