Executive brief
mt7688-wiscan is a WiFi scanning tool that runs on MediaTek Linkit Smart 7688 devices. Due to improper input sanitization in the scan function, an attacker with local access to the device or application can inject arbitrary shell commands, potentially allowing them to execute code, modify files, or disrupt the device's operations.
Technical details
The vulnerability is a command injection flaw (CWE-78, CWE-77) in the 'wiscan.scan' function due to insufficient input validation. User-supplied input is passed unsanitized to a shell command, allowing an attacker to inject shell metacharacters (e.g., semicolons, pipes) to execute arbitrary commands. The attack vector is local; the attacker must have the ability to call the vulnerable function with crafted input. The proof-of-concept demonstrates injection via `wiscan.scan(';touch EXPLOITED;#', callback)`. This allows arbitrary command execution with the privileges of the Node.js process. The vulnerability was fixed in version 0.8.3 by restricting the interface parameter to accept only alphabets and numbers.
Affected products
- mt7688-wiscan mt7688-wiscan before 0.8.3
Timeline
- 2022-12-20: disclosed
- 2023-02-01: advisory
- 2023-01-31: patched: Fix released in version 0.8.3