high8.8
CVE-2021-38557
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
Impact
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | billz/raspap-webgui | <= 2.6.6 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Raspap | Raspap | Version 2.6.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/RaspAP/raspap-webgui
- https://github.com/RaspAP/raspap-webgui/blob/fabc48c7daae4013b9888f266332e510b196a062/installers/raspap.sudoers
- https://zerosecuritypenetrationtesting.com/?page_id=306
- https://github.com/advisories/GHSA-536p-4pcj-5mr9
- https://nvd.nist.gov/vuln/detail/CVE-2021-38557