Summary
GL-iNet GL-MT3000 routers contain a command injection flaw in the native plugins interface, allowing attacker-controlled input to be executed as system commands via the /cgi-bin/glc endpoint.
When exposed to remote access, this issue can let an attacker run arbitrary commands on the device, leading to full router compromise and downstream network attacks.
Affected context
The vulnerability appears in GL-MT3000 deployments that expose the web management or plugin APIs, particularly the plugins.remove_package and plugins.install_package functions in the plugins.so Native Plugin via /cgi-bin/glc.
It tends to surface when user-supplied parameters for plugin operations are passed into shell commands without robust sanitization or neutralization, especially in environments where router administration interfaces are reachable from untrusted networks or via remote access features.
Exploit preconditions
- Attack surface: HTTP(S) requests to the router's
/cgi-bin/glcendpoint handling plugin management. - Required access: Ability to send crafted requests to the plugin functions (e.g.,
plugins.remove_packageorplugins.install_package); authentication requirements depend on the router's configuration. - Trigger point: Invocation of plugin management operations where user-controlled parameters are concatenated into or passed through system shell execution.
- Why exploitation is possible: Input destined for command arguments is not properly neutralized or constrained, allowing shell metacharacters or command sequences to be interpreted by the underlying OS rather than treated as data.
Why this happens
This flaw stems from building or invoking OS-level shell commands with untrusted input in the plugin handling logic, typically via APIs like system(), popen(), or equivalent wrappers that treat the constructed string as executable shell syntax.
The behavior aligns with CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-74 (Improper Neutralization of Special Elements in Output), where user-controlled values are embedded directly into command strings or output contexts without strict validation, escaping, or parameterization.
Abstractly, the insecure pattern is: application features that administer packages or plugins accept free-form strings and then interpolate these into shell commands without enforcing a whitelist of allowed values, thereby transforming configuration input into a code execution channel.
Potential impact
- Remote execution of arbitrary OS commands on the router
- Complete compromise of the device's operating system and configuration
- Modification of DNS, routing, or firewall rules to intercept or redirect traffic
- Installation of persistent malware or backdoors on the router
- Use of the router as a pivot point for attacks against internal network hosts
- Exfiltration or manipulation of network traffic passing through the device
General mitigation guidance
Effective mitigation focuses on eliminating direct shell command construction with user-controlled values and constraining plugin operations to safe, parameterized interfaces.
Patterns that help include:
- Replacing shell-based invocation with APIs or libraries that accept structured parameters rather than raw command strings.
- Applying strict allowlists for plugin names, package identifiers, and operation types, rejecting any input outside expected formats.
- Normalizing and validating all user-originated data before use, disallowing shell metacharacters and sequences that alter command flow.
- Running management components with least privilege so that, even if a command is abused, its impact is limited.
- Designing plugin and package workflows to operate on predefined repositories and identifiers instead of arbitrary paths or command fragments.
How teams detect issues like this
Detection commonly involves a mix of code-centric and behavioral approaches:
- Static analysis rules targeting use of shell execution APIs (
system,popen, backticks,os.system, etc.) with concatenated or formatted strings derived from HTTP request parameters. - Code review checklists that flag any plugin or package management features building command lines from user input, especially in CGI or native modules.
- Security testing that sends payloads containing shell metacharacters to plugin-related endpoints to verify whether they are executed or safely rejected.
- Runtime monitoring and logging of unusual command executions, unexpected processes, or anomalous traffic patterns originating from router management components.
- Policy enforcement in CI/CD that prevents merging changes introducing new direct shell invocations without proper sanitization or replacement with safer APIs.
