# DI-7100G vulnerability - Configuration File Command Injection 2

## 1. Basic Information

- Vendor: `D-Link`
- Product: `DI-7100G`
- Firmware Version: `C1`, `24.04.18D1`
- Vulnerability Type: `Command Injection`
- Update Time: `C1: 2020/02/21, 24.04.18D1: 2024/04/18`

## 2. Vulnerability Description

There is a **Command Injection Vulnerability** in the `start_proxy_client_email` function within the **rc file**. The vulnerability is located inside the function, with the issue being at lines 203-214 in `snprintf()` followed by `jhl_system(v4);`.

In this function, values of multiple configuration items are obtained from NVRAM, including `ac_mng_srv_host`, `proxy_http_srvport`, `lan_ipaddr`, `http_lanport`, etc. These configuration values are directly concatenated into the command string and then executed via the `jhl_system()` function.

Specifically, the value of the `ac_mng_srv_host` configuration field is obtained via `jhl_nv_get_def("ac_mng_srv_host")` and directly inserted into the execution command of the `pro_cli_ema.sh` script. If an attacker can modify the value of fields like `ac_mng_srv_host` in the configuration file to inject malicious commands (e.g., `"; telnetd -l /bin/sh;"`), these malicious commands will be executed when the device starts or triggers the proxy client email function, leading to arbitrary command execution.

This is a typical command injection vulnerability. The root cause is the lack of effective filtering and escaping of configuration item inputs, directly concatenating user-controllable configuration values into system commands for execution.

![image-20250731152218295](pic/wp/image-20250731152218295.png)

Vulnerability Code Snippet:

```c
int start_proxy_client_email()
{
  int result; // $v0
  const char *v1; // $s1
  const char *v2; // $s0
  const char *v3; // $v0
  char v4[1024]; // [sp+30h] [-40Ch] BYREF
  const char *def; // [sp+430h] [-Ch]

  memset(v4, 0, sizeof(v4));
  result = nvram_match_def("proxy_email_en", "1");
  if ( result )
  {
    nvram_set("proxy_http_status", "1");
    def = (const char *)jhl_nv_get_def("ac_mng_srv_host");
    v1 = (const char *)jhl_nv_get_def("proxy_http_srvport");
    v2 = (const char *)jhl_nv_get_def("lan_ipaddr");
    v3 = (const char *)jhl_nv_get_def("http_lanport");
    snprintf(
      v4,
      1024,
      "pro_cli_ema.sh \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" &",
      def,
      v1,
      v2,
      v3,
      "proxy_http_port",
      "proxy_http_msg",
      "proxy_http_pid");
    jhl_system(v4);
    pid_proxy_client_email = -2;
    return start_proxy_auto_send_email();
  }
  return result;
}
```

Exploit Effect Screenshot:

![image-20250731152227566](pic/wp/image-20250731152227566.png)

![image-20250731152350410](pic/wp/image-20250731152350410.png)

## 3. Impact

Attackers can inject malicious commands by modifying configuration items such as `ac_mng_srv_host`, `proxy_http_srvport`, `lan_ipaddr`, or `http_lanport` in the configuration file. When the device starts or triggers the proxy client email function, these malicious commands will be executed, potentially leading to:

- Remote control of the device
- Leakage of sensitive information
- Disruption of device functionality
- Opening backdoor services (e.g., telnetd)

## 4. Reporter

- #### ✨jfkk (jfkk2331997024@gmail.com)