A muhttpd HTTP server, primarily used in routers and access points, has a vulnerability (CVE-2022-31793) that allows an unauthenticated attacker to upload arbitrary files by sending a specially crafted HTTP request, depending on the permissions under which the HTTP server is running (in many devices, muhttpd runs with root privileges). For example, an attacker could gain access to password files, wireless access settings, provider connection parameters, and private keys.
The issue is caused by an error in processing the request path, which allows access to files outside the web server's root directory. The attack relies on specifying any additional character at the beginning of the path that is not a dot, slash, or question mark. For instance, to upload the file /etc/hosts, it is enough to send the request 'GET a/etc/hosts' or 'GET a/etc/hosts' (printf 'GET b/etc/hosts\n\n' | nc server port).
The reason for this behavior is that the requested file is opened using the command 'open(&req->filename[1], O_RDONLY)' after first executing the function chdir() to change to the root directory. Specifying &req->filename[1] results in ignoring the first character of the path (the developers assumed that the first character is always '/') . Thus, when sending the request 'GET /etc/hosts', the server will attempt to open the file using the relative path 'etc/hosts', but if any additional character is specified at the beginning ('GET a/etc/hosts')—the subsequent path will be fully processed. webszerverek. The issue has existed since the very first version of muhttpd and was resolved in release 1.1.7. The problem has been confirmed in devices using muhttpd, such as SaskTel and Arris routers. Potentially, the issue may also manifest in devices produced by AT&T, Frontier, and Windstream. If HTTP port access is restricted to the internal network, the attack can be executed from the external network using the 'DNS rebinding' technique, which allows sending an HTTP request to a network port not directly accessible through the internet when a user opens a certain page in their browser.
The issue has existed since the earliest version of muhttpd and was fixed in release 1.1.7. From the devices using muhttpd, the problem has been confirmed in SaskTel and Arris routers. The problem may potentially also occur in devices released by AT&T, Frontier, and Windstream. If access to the HTTP port is restricted to the internal network, the attack can still be performed from the external network using the 'DNS rebinding' technique, which allows sending an HTTP request to a network port that is not directly reachable from the internet when a user opens a specific page in their browser.
Forrás: opennet.ru
