Summary
RaspAP prior to version 2.6.6 is vulnerable to Privilege Escalation
Product
RaspAP prior to 2.6.6
Impact
Chaning this vulnerability with another one (see CVE-2021-33357 and CVE-2021-33358) enables an attacker to execute arbitrary commands with root privilages on the RaspAP instance.
Steps to reproduce
- Using CVE-2021-33357 or CVE-2021-33358, appent a command to /etc/raspap/lighttpd/configport.sh.
- Run the script with sudo. You won’t be asked for a password and the command will be run as root.
Expected result:
The file should only be editable to root.
Remediation
This issue was fixed in version 2.6.6 through the commit.
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Omri Inbar.
