Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The 
research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

nanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST 
/formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain object 
via nanodlpContext(). The Config object is a cross-request shared live pointer; Config.ShieldUnpause is writable, and 
Config.Save() persists it to db/machine.json without sanitization. An attacker injects [[Exec <cmd>]] into 
ShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the print engine to execute the G-code, 
reaching os/exec with shell semantics as root. Dynamically verified with uid=0(root).

Impact: Full read of the host filesystem and configuration as root, arbitrary OS command execution, and full control of 
the print server and host. The injected G-code is persisted and re-executes on every unpause.

Advisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/