CVE-2020-29390
📋 TL;DR
CVE-2020-29390 is a critical command injection vulnerability in Zeroshell 3.9.3 that allows unauthenticated attackers to execute arbitrary system commands via shell metacharacters in the StartSessionSubmit parameter. This affects all systems running the vulnerable Zeroshell version, particularly those exposed to untrusted networks.
💻 Affected Systems
- Zeroshell
📦 What is this software?
Zeroshell by Zeroshell
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands as root, install persistent backdoors, pivot to internal networks, and exfiltrate sensitive data.
Likely Case
Remote code execution leading to system takeover, installation of cryptocurrency miners or ransomware, and credential harvesting from the compromised router.
If Mitigated
Limited impact if system is isolated behind strict network controls, but still vulnerable to internal threats.
🎯 Exploit Status
Exploitation is straightforward using shell metacharacters and %0a (newline) characters. Public blog posts demonstrate working exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.9.3
Vendor Advisory: Not available - Zeroshell is open source with limited formal vendor support
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download latest Zeroshell version from official website. 3. Perform fresh installation or upgrade following Zeroshell documentation. 4. Restore configuration from backup. 5. Restart system.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to Zeroshell web interface using firewall rules
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Web Server Configuration
linuxAdd input validation or disable vulnerable endpoint
# Modify /etc/lighttpd/lighttpd.conf to add request filtering
# or disable /cgi-bin/kerbynet endpoint
🧯 If You Can't Patch
- Isolate Zeroshell system in separate VLAN with strict firewall rules allowing only necessary traffic
- Implement network-based intrusion detection to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if Zeroshell version is 3.9.3 via web interface or command line. Test by sending crafted request to /cgi-bin/kerbynet with StartSessionSubmit parameter containing shell metacharacters.Check Version:
cat /etc/zeroshell/version or check web interface dashboardVerify Fix Applied:
Verify Zeroshell version is updated beyond 3.9.3. Test exploitation attempt should fail with proper input validation error.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/kerbynet with shell metacharacters
- System commands executed from web server process
- Failed authentication attempts followed by successful command execution
Network Indicators:
- HTTP requests containing %0a or shell metacharacters in parameters
- Unexpected outbound connections from Zeroshell system
SIEM Query:
source="web_logs" AND uri="/cgi-bin/kerbynet" AND (param="*%0a*" OR param="*;*" OR param="*|*" OR param="*`*")