GL-iNet GL-AR300M16 Command Injection Vulnerability in System Log Retrieval

A command injection vulnerability has been identified in the GL-iNet GL-AR300M16 router running firmware version 4.3.11. The issue arises in the 'M.get_system_log' function of 'logread.lua', where the 'module' parameter is not properly sanitized before being used to construct system commands. This flaw allows attackers to execute arbitrary commands with root privileges by sending a crafted input via an HTTP request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with root privileges on the affected device.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to the '/rpc' endpoint with a JSON-RPC payload that includes a command injection in the 'module' parameter of the 'get_system_log' method. The injected command will be executed with root privileges.