[Security] Arbitrary File Write might lead to Remote Code Execution

[3sjay]

The upload.sh suffers from a path traversal which allows to create/overwrite arbitrary files as the Linux user the webserver is running as.

For example if the query string is "file=../../../../../tmp/test123" during the file upload, the respective file will be written to /tmp/test123.

Then we get to line 86 and the path to write the temporary file into is /usr/yi-hack-v4/../../../tmp/test123 for example which results in /tmp/test123 as the file path.

https://github.com/TheCrypt0/yi-hack-v4/blob/master/src/www/httpd/cgi-bin/upload.sh#L86

As it seems that the feature to update the binaries at line 76 would also allow for Remote Code Execution, as malicious binaries could be placed in there, I recommend to setup a password during installation either dynamically or chosen by the user.

I have to mention that I don't have a YI-Hack running, hence I just leave this simple PoC here.

echo pwned > pwned
curl -X POST <host>/upload.sh?file=../../../tmp/pwned -d "x=@pwned"