CVE-2023-37928

WSGI server command injection in Zyxel NAS326 V5.21(AAZF.14)C0 and NAS542 V5.21(ABAG.11)C0 firmware

• CVSS 8.8
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Input Validation and Sanitization
• Remote

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.

CVE

CVE-2023-37928

CWE

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS base score

8.8

Published

2023-11-30

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Apply the latest firmware updates for Zyxel NAS326 (V5.21(AAZF.14)C0) and NAS542 (V5.21(ABAG.11)C0)

from flask import Flask, request

app = Flask(__name__)

@app.route('/execute', methods=['POST'])
def execute_command():
    """Vulnerable function that demonstrates the security issue."""
    user_input = request.form.get('command')

    import subprocess
    result = subprocess.run(user_input, shell=True, capture_output=True, text=True)
    return result.stdout

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/execute', methods=['POST'])
def execute_command():
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    user_input = request.form.get('command')

    allowed_commands = {'ls', 'pwd', 'whoami'}
    if user_input not in allowed_commands:
        abort(400, 'Invalid command')

    import subprocess
    result = subprocess.run(user_input, shell=True, capture_output=True, text=True)
    return result.stdout

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202337928,
  title        = {{WSGI server command injection in Zyxel NAS326 V5.21(AAZF.14)C0 and NAS542 V5.21(ABAG.11)C0 firmware}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-37928},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-37928/}}
}