rConfig <= 3.94 Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2020-10221)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-10221) is a critical OS Command Injection flaw located in the lib/ajaxHandlers/ajaxAddTemplate.php file of rConfig. The root cause is the lack of proper input validation and sanitization on the fileName POST parameter before passing it to system shell execution functions. This allows authenticated users to append shell metacharacters and execute arbitrary system commands.

2. Exploitation Mechanics & Attack Scenario

An authenticated attacker sends a crafted HTTP POST request to the ajaxAddTemplate.php endpoint. By embedding shell metacharacters such as semicolons (;), ampersands (&), or pipes (|) followed by malicious commands inside the fileName parameter, the attacker forces the underlying operating system to execute those commands. Since the application runs under the privileges of the web server daemon (e.g., apache), the injected commands are executed with those same privileges, enabling unauthorized file modification or reverse shell establishment.

3. Infrastructure & Business Impact

Because rConfig is utilized to manage critical network infrastructure devices (routers, switches, firewalls), a compromise of the rConfig server poses an extreme risk. Attackers can extract stored device credentials and configuration files, potentially compromising the entire corporate network. The high EPSS score and its inclusion in the CISA KEV catalog highlight that this vulnerability is actively targeted and highly exploitable in the wild.