漏洞标题
N/A
漏洞描述信息
在D-Link DCS-1130设备上发现了一个问题。该设备为用户提供了将设备录制的视频片段设置到SMB文件夹的能力。似乎，在请求中传递的POST参数(用于测试电子邮件身份凭据和主机名发送到设备是否正确)会被作为函数中的“系统”API的指令，从而导致设备上的指令注入。如果使用binwalk工具来分析固件版本，我们会得到一个CIFS根文件系统卷，其中包含设备上建立的的所有二进制文件。库"libmailutils.so"具有一个脆弱函数"sub_1FC4"，接收POST请求发送的值。如果我们在IDA-pro中打开这个二进制文件，我们会注意到它遵循ARMLittleEndian格式。在IDA pro中的函数sub_1FC4被识别为接收POST请求发送的值，并在函数"sub_15AC"中提取了POST参数"receiver1"中的值，然后将其传递给脆弱系统API调用。在"cgibox"二进制文件的地址0x00023BCC中，我们可以访问该库的脆弱函数"send_mail"，如下所示：这将导致脆弱 POST 参数被传递给库，从而导致指令注入问题。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a "system" API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool, we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library "libmailutils.so" is the one that has the vulnerable function "sub_1FC4" that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter "receiver1" is extracted in function "sub_15AC" which is then passed to the vulnerable system API call. The vulnerable library function is accessed in "cgibox" binary at address 0x00023BCC which calls the "Send_mail" function in "libmailutils.so" binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
D-Link DCS-1130 命令注入漏洞
漏洞描述信息
D-Link DCS-1130是中国台湾友讯（D-Link）公司的一款网络摄像机。 D-Link DCS-1130中存在Snapshot功能存在命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。
CVSS信息
N/A
漏洞类别
命令注入