[FD] Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP 
stable build #10729 (Nano3Dtech). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

nanoDLP exposes an unauthenticated remote code execution vulnerability. The 
Guest (unauthenticated) endpoint POST /formula evaluates user-supplied 
JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain 
object via nanodlpContext(). The Config object is a cross-request shared live 
pointer; Config.ShieldUnpause is writable, and Config.Save() persists it to 
db/machine.json without sanitization. An attacker injects [[Exec <cmd>]] into 
ShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the 
print engine to execute the G-code, reaching os/exec with shell semantics as 
root. Dynamically verified with uid=0(root).

Impact: Full read of the host filesystem and configuration as root, arbitrary 
OS command execution, and full control of the print server and host. The 
injected G-code is persisted and re-executes on every unpause.

Advisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/