CVE-2023-50445: GL.iNet Router Firmware RCE Vulnerability

CVE-2023-50445 Overview

CVE-2023-50445 is a shell injection vulnerability affecting multiple GL.iNet router models. The vulnerability exists in the get_system_log, get_crash_log functions of the logread module, and the upgrade_online function of the upgrade module. Local attackers with low privileges can exploit this flaw to execute arbitrary code on affected devices, potentially gaining complete control over the router.

Critical Impact

Local attackers can execute arbitrary shell commands with elevated privileges, potentially compromising network security, intercepting traffic, or using the router as a pivot point for further attacks.

Affected Products

• GL.iNet GL-A1300 firmware v4.4.6
• GL.iNet GL-AX1800 firmware v4.4.6
• GL.iNet GL-AXT1800 firmware v4.4.6
• GL.iNet GL-MT3000 firmware v4.4.6
• GL.iNet GL-MT2500 firmware v4.4.6
• GL.iNet GL-MT6000 firmware v4.5.0
• GL.iNet GL-MT1300 firmware v4.3.7
• GL.iNet GL-MT300N-V2 firmware v4.3.7
• GL.iNet GL-AR750S firmware v4.3.7
• GL.iNet GL-AR750 firmware v4.3.7
• GL.iNet GL-AR300M firmware v4.3.7
• GL.iNet GL-B1300 firmware v4.3.7

Discovery Timeline

• December 28, 2023 - CVE-2023-50445 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-50445

Vulnerability Analysis

This shell injection vulnerability (CWE-78: OS Command Injection, CWE-77: Command Injection) allows local attackers to execute arbitrary code on affected GL.iNet routers. The vulnerability stems from improper input sanitization in the device's API functions. Specifically, the get_system_log and get_crash_log functions within the logread module, along with the upgrade_online function in the upgrade module, fail to properly validate and sanitize user-supplied input before passing it to shell commands.

When exploited, an attacker with local access and low-level privileges can inject shell metacharacters into API requests, causing the device to execute arbitrary commands with the privileges of the underlying system process. This can lead to complete device compromise, including the ability to modify firmware, exfiltrate sensitive configuration data, or establish persistent backdoor access.

Root Cause

The root cause of CVE-2023-50445 is the failure to properly sanitize user-controlled input before using it in shell command execution contexts. The affected functions in the logread and upgrade modules construct shell commands using user-supplied parameters without adequate input validation or escaping of shell metacharacters. This allows attackers to break out of the intended command context and inject malicious commands that will be executed by the system shell.

Attack Vector

The attack requires local access to the device, meaning the attacker must either have physical access or be connected to the router's network. With low-privilege access, an attacker can craft malicious API requests targeting the vulnerable functions. By including shell metacharacters (such as semicolons, backticks, or command substitution syntax) in the request parameters, the attacker can inject arbitrary commands that will be executed when the API processes the request.

The vulnerability mechanism involves shell metacharacter injection via the GL.iNet router API. The affected functions get_system_log, get_crash_log, and upgrade_online accept user input that is subsequently passed to system shell commands without proper sanitization. For detailed technical information and exploitation specifics, refer to the GL.iNet CVE Issues Documentation and the Packet Storm Security Advisory.

Detection Methods for CVE-2023-50445

Indicators of Compromise

• Unexpected processes or services running on the router that were not configured by administrators
• Modified system logs or gaps in logging that may indicate tampering with the logread module
• Unauthorized firmware modifications or configuration changes to the upgrade module
• Unusual outbound network connections from the router to unknown external IP addresses

Detection Strategies

• Monitor API request logs for unusual patterns, particularly requests to the get_system_log, get_crash_log, and upgrade_online endpoints containing shell metacharacters
• Implement network monitoring to detect anomalous traffic patterns originating from GL.iNet routers
• Deploy SentinelOne Singularity to monitor for command injection attack patterns and suspicious process execution chains on network infrastructure

Monitoring Recommendations

• Enable verbose logging on affected GL.iNet devices and forward logs to a centralized SIEM for analysis
• Monitor for unexpected shell process spawning, particularly processes spawned by web server or API handler components
• Implement file integrity monitoring on critical router configuration files and firmware components

How to Mitigate CVE-2023-50445

Immediate Actions Required

• Inventory all GL.iNet devices in your environment and identify those running vulnerable firmware versions
• Restrict network access to router management interfaces to trusted administrators only
• Implement network segmentation to limit the potential impact of a compromised router
• Apply firmware updates from GL.iNet as soon as they become available

Patch Information

Organizations should check the official GL.iNet support channels and firmware download pages for updated firmware versions that address CVE-2023-50445. The vendor has documented this issue in their GitHub CVE Issues repository.

Workarounds

• Disable remote management features and restrict access to the router's web interface to local connections only
• Implement strict firewall rules to limit which users and systems can access the router's API endpoints
• Consider using network access control lists (ACLs) to restrict API access to authorized administrative systems only
• Monitor affected devices closely while awaiting official patches, and consider temporary replacement with unaffected hardware for critical network segments

# Restrict access to router management interface (example iptables rule)
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP