CVE-2021-33357 PoC — RaspAP 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33357.yaml

Associated Vulnerability

Title:RaspAP 操作系统命令注入漏洞 (CVE-2021-33357)
Description:RaspAP是应用软件基于 Debian 的设备的简单无线 AP 设置和管理 RaspAP存在操作系统命令注入漏洞，该漏洞源于在RaspAP 2.6版本到2.6.5版本中未正确过滤“iface”参数中的“;”等特殊字符。攻击者利用该漏洞就可以执行任意的操作系统命令。

Description

RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";".

File Snapshot


 id: CVE-2021-33357

info:
  name: RaspAP <=2.6.5 - Remote Command Injection
  author: pikpikcu,pdtea

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!