OpenWrt cgi-io ACL Bypass: Arbitrary Root File Read (CVE-2020-25947) with POC

Vulnerability Overview Vulnerability Name: ACL bypass and arbitrary root file read via cgi-io cgi-download CVE ID: CVE-2020-25947 Severity: Moderate (4.9 / 10) CVSS v3 base metrics: Attack vector: Network Attack complexity: Low Privileges required: High User interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None Description: The handler in authorizes the requested path based on the caller's ubus session file ACL and opens it without path normalization. This leads to a security vulnerability allowing an attacker to read any read-only file, including . Affected Scope Affected Versions: versions Affected Systems: OpenWrt . In OpenWrt 25.12.4, is a symbolic link to . Requires an authenticated ubus session holding access permissions (access group plus wildcard file read permissions, such as , , or ). In a default single-node installation, the root LuCI session holds these permissions. Deployments delegating restricted login operators to the flash access group are also affected under lower privileges. Unauthorized requests are rejected at ; therefore, the vulnerability is not anonymously reachable. Remediation Fixed Version: version POC Code Impact Disclosure of unencrypted password hashes in , which can be cracked offline to obtain root login credentials. Disclosure of Wi-Fi PSKs, WireGuard and OpenVPN private keys, and PPPoE credentials in . Disclosure of SSH host keys in and TLS private key in . Reading any file readable by uid 0, including and . Credits Jan Kahmen, turingcomplete (jan@turingcomplete.de)

Goal Reached Thanks to every supporter — we hit 100%!

OpenWrt cgi-io ACL Bypass: Arbitrary Root File Read (CVE-2020-25947) with POC

More from this source