HTTP-server muhttpd, which is mainly used in routers and access points, has a vulnerability (CVE-2022-31793) that allows an unauthenticated attacker to upload arbitrary files by sending a specially crafted HTTP request, subject to the access rights under which the HTTP server runs (in many devices, muhttpd runs with root privileges). For example, an attacker may gain access to password files, wireless access settings, ISP connection parameters, and private keys.
The issue is caused by an error in processing the path in the request, which allows access to files outside the web server's root directory. The attack involves specifying any additional character at the beginning of the path, other than a dot, slash, or question mark. For example, to upload the file /etc/hosts, it is sufficient to send the request "GET a/etc/hosts" or "GET a/etc/hosts" (printf "GET b/etc/hosts\n\n" | nc server port).
The cause of the specified behavior is that opening the requested file is performed by the command "open(&req->filename[1], O_RDONLY)" after executing the chdir() function to switch to the root directory. Specifying &req->filename[1] leads to the first character of the path being ignored (the developers assumed the first character is always "/"). Thus, when requesting "GET /etc/hosts", the server attempts to open the file with the relative path "etc/hosts", but if any additional character is specified at the beginning ("GET a/etc/hosts") — the subsequent path will be processed completely. veebiserverThe issue has been present since the very first version of muhttpd and has been fixed in release 1.1.7. From the devices using muhttpd, the issue has been confirmed in the routers from SaskTel and Arris. Potentially, the issue may also appear in devices produced by AT&T, Frontier, and Windstream. When HTTP port access is restricted to the internal network, the attack can be executed from the external network using the "DNS rebinding" technique, allowing a user's browser to send an HTTP request to a network port that is not directly accessible via the internet when a certain page is opened.
The issue has been present since the very first version of muhttpd and has been fixed in release 1.1.7. From the devices using muhttpd, the issue has been confirmed in the routers from SaskTel and Arris. Potentially, the issue may also appear in devices produced by AT&T, Frontier, and Windstream. When HTTP port access is restricted to the internal network, the attack can be executed from the external network using the "DNS rebinding" technique, allowing a user's browser to send an HTTP request to a network port that is not directly accessible via the internet when a certain page is opened.
Allikas: opennet.ru
