Summary
RaspAP prior to version 2.6.6 is vulnerable to Unauthenticated Command Injection
Product
RaspAP prior to 2.6.6
Impact
An unauthenticated attacker can execute arbitrary OS commands on any RaspAP instance prior tp 2.6.6. This can be chained with a privilege escalation exploit (CVE-2021-33356) to achieve root access.
Steps to reproduce
Expected result:
Your injected command should run on the RaspAP host.
Remediation
This issue was fixed in version 2.6.6 through the commit.
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Omri Inbar.
