Shibby Tomato OS Command Injection Vulnerability in CIFS Mount Handler

A command injection vulnerability has been identified in Shibby Tomato firmware versions prior to 1.28.0000. The issue resides in the CIFS mount handler, specifically within the 'sbin/rc' component, which is hardlinked to 'mount-cifs'. The vulnerability allows remote execution of arbitrary commands by manipulating the 'cifs1' or 'cifs2' NVRAM keys. The exploitation occurs after successfully mounting a CIFS share, where the unsanitized command from the NVRAM is executed as root via the 'system()' function.

Impact

Exploitation of this vulnerability leads to unauthorized command execution with root privileges on the affected device.

Reproduction

The vulnerability can be reproduced by setting the 'cifs1' NVRAM key to include a command injection payload, such as a command to create a file in the '/tmp' directory. After committing the NVRAM change, the 'mount-cifs' service can be started, which triggers the command execution via the CIFS mount handler.