A vulnerability (CVE-2022-31793) has been identified in the muhttpd HTTP server, primarily used in routers and access points, which allows an unauthenticated attacker to upload arbitrary files through a specially crafted HTTP request, depending on the access rights under which the HTTP server runs (in many devices, muhttpd runs with root privileges). For example, an attacker could gain access to password files, wireless access settings, provider connection parameters, and private keys.
The issue is caused by a flaw in the path processing of the request, which enables access to files outside the root directory of the web server. The attack involves prefixing the path with any additional character other than a dot, slash, or question mark. For instance, to load the file /etc/hosts, it is sufficient to send the request 'GET a/etc/hosts' or 'GET a/etc/hosts' (printf 'GET b/etc/hosts\n\n' | nc server port).
The reason for this behavior is that the requested file opening is performed by the command 'open(&req->filename[1], O_RDONLY)' with a prior execution of the chdir() function to change to the root directory. web serverSpecifying &req->filename[1] causes the first character of the path to be ignored (the developers assumed that the first character would always be '/'). Thus, with the request 'GET /etc/hosts', the server attempts to open the file with the relative path 'etc/hosts', but if any additional character is prefixed ('GET a/etc/hosts') — the subsequent path will be fully processed.
The problem exists from the very first version of muhttpd and has been fixed in release 1.1.7. Among the devices using muhttpd, the issue has been confirmed in routers from SaskTel and Arris. The problem may also appear in devices produced by AT&T, Frontier, and Windstream. When HTTP port access is restricted to the internal network, an attack can be conducted from the external network using 'DNS rebinding' techniques, allowing an HTTP request to be sent to a network port that is not directly accessible via the internet when a user opens a specific page in their browser.
Source: opennet.ru
