Summary
A command injection issue in GL.iNet GL-MT3000's Logread Lua RPC plugin allows crafted input to the module parameter to be interpreted as shell commands.
When exposed over the network, a remote attacker can leverage this flaw to execute arbitrary commands on the device with the privileges of the web or system service.
Affected context
This vulnerability occurs in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5, specifically within the Logread Lua RPC plugin used for retrieving system logs.
It manifests when the logread.get_system_log function processes the module argument and passes it into underlying shell or system log utilities without robust sanitization.
The risk is highest in deployments where the administrative web interface or RPC endpoint is reachable from untrusted networks or shared environments.
Exploit preconditions
- Attack surface: HTTP/Lua RPC interface for log retrieval (
logreadRPC plugin). - Required access: Ability to send requests to the vulnerable RPC endpoint (typically network access to the device's management interface; authentication requirements may vary by configuration).
- Trigger point: Supplying a crafted
moduleargument that is concatenated or interpolated into a shell command executed by the system. - Why exploitation is possible: User-supplied data is incorporated into command execution logic without proper escaping, validation, or use of safe APIs, enabling attackers to break out of intended parameters and inject additional commands.
Why this happens
The underlying bug aligns with CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') and is closely related to CWE-74: Improper Neutralization of Special Elements in Output.
In the Logread Lua RPC plugin, the module argument is treated as a trustworthy value and passed to shell or command-line utilities, likely via string concatenation or templating.
Because meta-characters, separators, or control operators are not stripped or constrained, an attacker can craft input that alters the command structure, appending arbitrary instructions.
Abstractly, this pattern reflects a broader class of issues where untrusted input is mixed with command syntax instead of being handled as opaque data through parameterized or API-based execution.
Potential impact
- Remote execution of arbitrary shell commands on the GL-MT3000 device.
- Unauthorized access to system logs and sensitive diagnostic information.
- Modification of device configuration, firewall rules, or routing behavior.
- Deployment of malware or backdoors on the router, impacting all connected clients.
- Use of the compromised device as a pivot point for attacks on internal networks.
General mitigation guidance
Effective mitigation focuses on breaking the link between untrusted input and command syntax.
Common patterns include:
- Replacing shell-based command construction with high-level, parameterized APIs that treat arguments as data, not executable text.
- Strictly validating the
moduleparameter against an allowlist of expected values or log sources, rejecting anything outside the defined set. - Neutralizing or rejecting input containing command separators, metacharacters, or unexpected whitespace that could alter execution flow.
- Running the web/RPC service with least-privilege accounts, limiting the impact of any command that is executed.
- Minimizing exposure of administrative interfaces to untrusted networks and isolating management traffic with segmentation or VPN access.
How teams detect issues like this
Detection typically relies on a combination of code-centric and operational approaches:
- Static analysis rules that flag patterns where user-controlled variables are passed to
os.execute, shell calls, or similar command APIs without sanitization. - Manual code reviews focused on RPC handlers and log utilities, checking for string concatenation into commands or direct shell invocation from Lua or other languages.
- Security testing that exercises RPC endpoints with payloads containing common command injection markers to observe unexpected behavior.
- Policy enforcement in CI/CD pipelines requiring safe execution primitives, input validation, and explicit review for any command construction logic.
- Runtime monitoring for anomalous command executions or processes spawned by the web or RPC service, which may indicate active exploitation attempts.
