SSD Advisory – Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution

Vulnerability summary
The following advisory describes an Unauthenticated Remote Command Execution vulnerability found in Netgear ReadyNAS Surveillance.

Netgear ReadyNAS Surveillance – Small businesses and corporate branch offices require a secure way to protect physical assets, but often lack the security expertise or big budget that most solutions require. With these challenges in mind, NETGEAR introduces ReadyNAS Surveillance, easy-to-use network video recording (NVR) software that installs directly to a ReadyNAS storage device. Add a set of cameras to a Power over Ethernet ProSafe switch and your surveillance network is up and running in no time.

Credit
An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

Vendor response
Netgear was informed of the vulnerability on June 27, but while acknowledging the receipt of the vulnerability information, refused to respond to the technical claims, to give a fix timeline or coordinate an advisory.

Vulnerability details
User controlled input is not sufficiently sanitized when passed to upgrade_handle.php.

As we can see, $_GET['uploaddir'] is not escaped and passed to system() through $tmp_upload_dir

By sending the following parameters

The input will be execute.

Proof of Concept