Easywall Command Injection Vulnerability Leading to Remote Command Execution

A command injection vulnerability has been identified in Easywall version 0.3.1, allowing authenticated users to execute arbitrary commands on the server via the '/ports-save' endpoint. The vulnerability arises from improper handling of command delimiters, enabling the injection of shell metacharacters.

Impact

Exploitation of this vulnerability allows for authenticated remote command execution on the server.

Reproduction

To reproduce this vulnerability, log into the application with valid credentials. Once authenticated, send a POST request to the '/ports-save' endpoint with injected shell metacharacters in the 'port' parameter. This injection exploits the command execution flaw by appending a reverse shell command. After the payload is sent, trigger the execution by posting to the '/apply-save' endpoint. If successful, a reverse shell will be established.