Read-Only user can execute arbitraty shell commands on AirOS
该报告还没有中文解读。
原文摘录
摘自原文（2119 字符中的一小部分）
This vulnerability is very similar to #128750, but it avoid the solution applied to the last beta XM firmware.
原文中的代码
if ($res == -11) { #received the redirect
# got redirect, will have to try new one (if that's login.cgi)
$lcount = count($lines);
if ($lcount > 0) {
$new_url = $lines[$lcount - 1]; # the URL returned by the attacker have shell code injected
}
$rg_login = …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Ubiquiti Inc. 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @rbran · 版权归作者与 Ubiquiti Inc. 所有