OpenWrt Procd PATH Variable Filter Bypass Vulnerability Leading to Privilege Escalation

A vulnerability in the OpenWrt Project's Procd component, present in versions prior to 24.10.6, allows for a bypass of environment variable filtering in the hotplug_call function. This flaw enables an attacker to inject an arbitrary PATH variable, potentially leading to privilege escalation. The issue arises because the function incorrectly uses strcmp to compare the full environment string against the literal 'PATH', causing the filter to fail. As a result, the PATH variable is not excluded, allowing manipulation of which binaries are executed by scripts with elevated privileges.

Impact

Exploitation of this vulnerability could allow an attacker to gain unauthorized privileges by manipulating the execution environment of scripts run by Procd.

Remediation

Users can upgrade to OpenWrt version 24.10.6 or later to address this vulnerability.