Ruijie RG-EW1300G and BE50 OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in Ruijie RG-EW1300G versions V1.00, V2.00, and V4.00, as well as the BE50 product running EW_3.0B11P258_EW5000_11171513BE50. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the affected device by sending specially crafted POST requests to a vulnerable Lua service.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'module_get' endpoint in 'networkConnect.lua' with a payload that includes the desired command to be executed on the system. This can be done using a tool like curl or Postman, ensuring that the request is authenticated.