RaspAP Vulnerability: Root Access at Risk for Raspberry Pi Users
Security researcher Zonifer has uncovered a critical vulnerability (CVE-2024-41637) in RaspAP, a popular open-source tool used to turn Raspberry Pi devices into wireless access points. This vulnerability could allow a local attacker to escalate their privileges from a standard user to the all-powerful “root” user, giving them complete control over the Raspberry Pi.
The root cause of the vulnerability lies in a combination of factors:
-
Write Access: The “www-data” user, typically used for web server processes, has write access to the
restapi.servicefile. -
Sudo Privileges: The “www-data” user also possesses sudo privileges to execute certain critical commands without needing a password.
This dangerous combination allows an attacker to modify the restapi.service file, injecting malicious code that will be executed with root privileges when the service is restarted.
Zonifer provided a detailed proof of concept (PoC) exploit to demonstrate how the CVE-2024-41637 vulnerability can be exploited to gain root access. The steps involve modifying the service configuration, rebooting the machine, and manipulating the service to set the SUID bit on /bin/bash, ultimately allowing the attacker to run the shell with root privileges.
Successful exploitation of this vulnerability could have severe consequences:
- Complete System Compromise: An attacker with root access can modify any file, install malicious software, steal sensitive data, and even disable the device.
- Network Compromise: Since RaspAP is often used to manage wireless networks, an attacker could intercept network traffic, launch further attacks against other devices, or redirect users to malicious websites.
Users of RaspAP are strongly advised to take the following actions immediately:
- Update RaspAP: Check for and install any available updates from the RaspAP developers.
- Restrict Sudo Privileges: If you do not need the “www-data” user to have sudo access, remove those privileges.
- Monitor for Suspicious Activity: Keep a close eye on your Raspberry Pi’s logs for any signs of unauthorized access or modification of system files.
