Ruijie RG-EW1800GX and RG-EW300R OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in Ruijie RG-EW1800GX and RG-EW300R devices. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the affected system. The issue arises in the Lua services, specifically through crafted POST requests to the module_set in the config_retain.lua file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the module_set endpoint in the config_retain.lua file. The request must be crafted to include the desired commands for execution. This can be done using a tool that allows for the manipulation of HTTP requests, such as Burp Suite or Postman.