CVE-2023-37927

Zyxel NAS326 and NAS542 V5.21(AAZF.14)C0/(ABAG.11)C0 CGI command injection

• CVSS 8.8
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Input Validation and Sanitization
• Remote

The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

CVE

CVE-2023-37927

CWE

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS base score

8.8

Published

2023-11-30

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Apply the latest firmware updates for Zyxel NAS326 (V5.21(AAZF.14)C0) and NAS542 (V5.21(ABAG.11)C0)

import cgi
import subprocess

def handle_request(environ):
    """Vulnerable function that demonstrates the security issue."""
    query_string = environ.get('QUERY_STRING', '')

    command = f'echo {query_string}'
    result = subprocess.run(command, shell=True, capture_output=True, text=True)

    return result.stdout

import cgi
import subprocess

def handle_request(environ):
    """Secure function that fixes the vulnerability."""
    query_string = environ.get('QUERY_STRING', '')
    escaped_query = cgi.escape(query_string)

    command = ['echo', escaped_query]
    result = subprocess.run(command, capture_output=True, text=True)

    return result.stdout

@misc{vaitp:cve202337927,
  title        = {{Zyxel NAS326 and NAS542 V5.21(AAZF.14)C0/(ABAG.11)C0 CGI command injection}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-37927},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-37927/}}
}