[0day-rubbish] MultiTech Conduit AEP 6.3.6 Authenticated import_config filename command injection to root RCE (7.2)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in MultiTech
Conduit AEP (models mtcdt / mtcdtip / mtcdtiphp), IoT gateways running mLinux on
ARM 32-bit.

Type: authenticated OS command injection (CWE-78) through the uploaded filename
of the admin-only upload_config command. The management API is served by lighttpd
on TCP 8080 and proxied to the proprietary FastCGI daemon /usr/bin/rcell_api. The
import_config handler wraps the client-supplied filename in single quotes to
build import_config '<filename>' and runs it through MTS::System::cmd, which
disassembly confirms is popen(cmd, "r"), that is /bin/sh -c. The multipart parser
strips only surrounding double quotes and reduces the value to a basename; single
quotes are never escaped, so a filename of x'; <CMD> ;# breaks out of the quoting.

Scoring. Single base score, not dual-scored:
- 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. PR:H because
  command/upload_config is granted only in the administrator permission profile.

Impact: root command execution on a gateway that bridges constrained field devices
with IP infrastructure (the daemon runs as uid 0), giving full filesystem read,
configuration rewrite, persistence and pivot. The injected command output is
redirected rather than echoed, so the injection is blind at the protocol level and
confirmation rests on a server-side artefact.

Authentication: authenticated administrator. No factory default credentials exist;
the administrator account is provisioned by the deployer at commissioning. An
exhaustive review of the unauthenticated surface found no route to this sink
without a valid admin session, so the finding is scoped as post-authentication.

Verification boundary, stated plainly. Verified end to end by emulation only:
the root filesystem extracted from the AEP 6.3.6 firmware image was run under
qemu-arm-static inside a chroot and started through its angel supervisor, with no
physical Conduit device used at any point. Against the running daemon in socket
mode with an admin session established from a non-loopback REMOTE_ADDR, the upload
returned {"code":200,"status":"success","type":"upload"} and produced a root-owned
marker containing uid=0(root) gid=0(root) groups=0(root), while a benign filename
returned HTTP 400 and created nothing. AEP 6.3.0 is evidenced by patch diff (the
import_config handler is unchanged); the claimed range 6.3.0 through 6.3.6 follows
from that endpoint comparison and the intermediates were not each executed.

Full technical analysis and a reproducible proof-of-concept:
  https://0day-rubbish.com/blog/multitech-conduit-import-config-command-injection

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.

--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/