ChargePoint Home Flex Command Injection Vulnerability Allowing Privileged Command Execution

A command injection vulnerability has been identified in ChargePoint Home Flex version 5.5.4.13. The issue arises in the 'uploadsm' component, which fails to properly validate user-controlled input for bz2 decompression. This lack of validation enables local users to execute arbitrary commands with 'nobody' privileges.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with elevated privileges, as the 'nobody' user.

Reproduction

To reproduce this vulnerability, send a POST request to the 'uploadsm' binary with a bz2 file that includes a payload in the decompression string. The absence of string length validation allows the injection of commands, which will be executed with 'nobody' privileges.