Summary
A command injection vulnerability in the nas-web RPC Wrapper of GL.iNet GL-MT3000 allows attackers to inject arbitrary system commands via the nas-web.add_user function exposed through /cgi-bin/glc.
When user-controlled parameters are passed unsafely into shell commands, a remote attacker can leverage this flaw to execute code on the device, especially in deployments that expose the web or RPC interface to untrusted networks.
Affected context
This issue arises in GL.iNet GL-MT3000 devices running firmware up to version 4.4.5, specifically in environments where:
- The nas-web RPC Wrapper is enabled and accessible
- The
/cgi-bin/glcendpoint is reachable over the network - User-supplied input to
nas-web.add_useris processed without robust sanitization or neutralization
Risk is elevated when the management or RPC interface is exposed beyond a trusted administrative network or is reachable by untrusted clients.
Exploit preconditions
- Attack surface: HTTP/RPC interface on the GL-MT3000 (
/cgi-bin/glcendpoint) - Required access: Network reachability to the device's management or RPC port; authentication requirements depend on specific configuration
- Trigger point: Invocation of the
nas-web.add_userfunction with crafted parameters that pass through to shell command execution - Why exploitation is possible: User-controlled data is concatenated or embedded into system command lines without proper command or argument neutralization, enabling injection of additional shell metacharacters and commands
Why this happens
The underlying flaw is an instance of command injection (CWE-77) due to improper neutralization of special elements used in OS command strings. Within the nas-web RPC Wrapper, the nas-web.add_user handler appears to build shell commands from request parameters and execute them in the underlying operating system.
Instead of treating input strictly as data (e.g., validated arguments or structured parameters), the implementation allows attacker-controlled content to influence the command structure itself. This behavior aligns with CWE-74 and CWE-77, where failure to sanitize or constrain metacharacters and reserved syntax in inputs leads to unintended command execution.
Potential impact
- Remote execution of arbitrary system commands on the GL-MT3000 device
- Complete compromise of the router, including configuration and stored credentials
- Traffic interception, manipulation, or redirection through the compromised device
- Use of the router as a pivot point for attacks against internal network hosts
- Deployment of persistent malware or participation in botnets
General mitigation guidance
Effective mitigation focuses on eliminating direct string-based command construction and enforcing strict separation between data and executable logic. Common secure patterns include:
- Avoiding shell invocation for user management operations; instead use dedicated system APIs or libraries that do not interpret shell metacharacters
- Applying rigorous input validation for all RPC parameters, restricting values to well-defined formats (e.g., usernames with whitelists of allowed characters)
- Using parameterized command execution mechanisms or argument arrays where shell parsing is bypassed entirely
- Running management and RPC components with least privilege so that, even if misbehavior occurs, the blast radius is limited
- Restricting exposure of the management and RPC interfaces to trusted administrative networks, reducing opportunities for untrusted input to reach the vulnerable path
How teams detect issues like this
Organizations can identify similar command injection risks through a combination of static and dynamic techniques:
- Static analysis rules that flag uses of system(), popen(), exec*, or shell invocation APIs where user input influences command strings
- Code review practices that scrutinize RPC and web handlers for direct concatenation of request parameters into OS command lines
- Policy-based checks that require non-shell mechanisms for administrative operations like user management and configuration changes
- Runtime security monitoring on embedded devices, looking for anomalous command executions or unexpected process trees originating from web/RPC daemons
Automated code scanning and firmware security review tools can help surface these patterns before deployment or during regular security assessments.
