CVE-2017-9807

OpenWebif plugin (through 1.2.4) in E2 open devices allows remote code execution via eval in saveConfig function using the "key" HTTP GET parameter

• CVSS 9.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig.

CVE

CVE-2017-9807

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

9.8

Published

2017-06-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update OpenWebif plugin to version 1.2.5 or higher.

from flask import request

def save_config():
    """Vulnerable function that demonstrates the security issue."""
    key = request.args.get('key')
    
    eval_result = eval(key)

    return {"result": eval_result}

from flask import request
from ast import literal_eval

def save_config():
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    key = request.args.get('key')

    try:
        eval_result = literal_eval(key)
    except (ValueError, SyntaxError):
        return {"error": "Invalid input"}, 400

    return {"result": eval_result}

@misc{vaitp:cve20179807,
  title        = {{OpenWebif plugin (through 1.2.4) in E2 open devices allows remote code execution via eval in saveConfig function using the "key" HTTP GET parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-9807},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-9807/}}
}