CVE-2025-60691

...

6.1 Ghidra

apply_cgi function

• Only the relevant code portions to the CVE is shown

undefined4
apply_cgi(FILE *param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,undefined4 param_5,
         char *param_6,char *param_7)

{
  char *pcVar1;
  int iVar2;
  char *__s1;
  char *pcVar3;
  FILE *__stream;
  undefined4 uVar4;
  undefined **ppuVar5;
  undefined1 *puVar6;
  uint __seconds;
  char local_838;
  undefined1 auStack_837 [2047];
  char *local_38;
  int local_34;
  int local_30;
  
  pcVar1 = (char *)get_cgi(0x49f270);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "0";
  }
  local_30 = atoi(pcVar1);
  pcVar1 = (char *)get_cgi(0x49f188);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "1";
  }
  local_34 = atoi(pcVar1);
  local_38 = (char *)get_cgi(0x49f27c);
  error_value = 0;
  pcVar1 = (char *)get_cgi(0x49f288);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "";
  }
  iVar2 = strcmp(pcVar1,"gozila_cgi");
  if (iVar2 == 0) {
    gozila_cgi(param_1);
    return 1;
  }
  __s1 = (char *)get_cgi(0x49edc0);
  if (__s1 == (char *)0x0) {
    __s1 = "";
    if (param_7 != (char *)0x0) goto LAB_00421bc0;
LAB_00421d74:
    puVar6 = (undefined1 *)0x0;
    __seconds = 0;
  }
  else {
    if (param_7 == (char *)0x0) goto LAB_00421d74;
LAB_00421bc0:
    if (param_6 != (char *)0x0) {
      iVar2 = strcmp(param_6,"tmBlock.cgi");
      if (iVar2 == 0) {
        local_838 = '\0';
        memset(auStack_837,0,0x7ff);
        iVar2 = get_cgi(0x4a2600);
        sprintf(&local_838,"http://%s",iVar2);
        nvram_set("TM_block_url",&local_838);
        iVar2 = get_cgi(0x4a35cc);
        nvram_set("TM_block_index",iVar2);
        iVar2 = get_cgi(0x4a1474);
        nvram_set("TM_block_hwaddr",iVar2);
        pcVar1 = (char *)get_cgi(0x49f2ec);
        if ((pcVar1 == (char *)0x0) || (iVar2 = strcmp(pcVar1,"1"), iVar2 != 0)) {
          do_ej("tmWTPBlock.asp",param_1);
        }
        else {
          do_ej("tmPCBlock.asp",param_1);
        }
        wfflush(param_1);
        return 1;
      }
      iVar2 = strcmp(param_6,"hndBlock.cgi");
      if (iVar2 == 0) {
        local_838 = '\0';
        memset(auStack_837,0,0x7ff);
        iVar2 = get_cgi(0x4a2600);
        sprintf(&local_838,"http://%s",iVar2);
        nvram_set("hnd_block_url",&local_838);
        iVar2 = get_cgi(0x49bfd0);
        nvram_set("hnd_block_policy",iVar2);
        iVar2 = get_cgi(0x4a1474);
        nvram_set("hnd_block_mac",iVar2);
        iVar2 = get_cgi(0x49f6a0);
        nvram_set("hnd_block_ip",iVar2);
        pcVar1 = (char *)get_cgi(0x49f2ec);
        if ((pcVar1 == (char *)0x0) || (iVar2 = strcmp(pcVar1,"0"), iVar2 != 0)) {
          do_ej("BlockSite.asp",param_1);
        }
        else {
          do_ej("BlockTime.asp",param_1);
        }
        nvram_set("hnd_password_deny",&DAT_0049ea84);
        wfflush(param_1);
        return 1;
      }
    }

...

• From previous fuzzing steps, we know that we can reach the apply_cgi function with the simple HTTP request (other headers and parameters redacted):

POST /apply.cgi

6.1.1 Analysis of the source code

1. From the apply_cgi function earlier, we can understand the following:

a. Function arguments

apply_cgi(FILE *param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,undefined4 param_5,
         char *param_6,char *param_7)

b. Values required for the variables, in order for the control flow to reach the vulnerable code portion

 //... variable declaration portion
 
 pcVar1 = (char *)get_cgi(0x49f270);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "0";
  }
  local_30 = atoi(pcVar1);
  pcVar1 = (char *)get_cgi(0x49f188);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "1";
  }
  local_34 = atoi(pcVar1);
  local_38 = (char *)get_cgi(0x49f27c);
  error_value = 0;
  pcVar1 = (char *)get_cgi(0x49f288);
  if (pcVar1 == (char *)0x0) {
    pcVar1 = "";
  }
  iVar2 = strcmp(pcVar1,"gozila_cgi");
  if (iVar2 == 0) {
    gozila_cgi(param_1);
    return 1;
  }
  __s1 = (char *)get_cgi(0x49edc0);
  if (__s1 == (char *)0x0) {
    __s1 = "";
    if (param_7 != (char *)0x0) goto LAB_00421bc0;
LAB_00421d74:
    puVar6 = (undefined1 *)0x0;
    __seconds = 0;
  }
  else {
    if (param_7 == (char *)0x0) goto LAB_00421d74;
LAB_00421bc0:
    if (param_6 != (char *)0x0) {
    
    // ...vulnerable code portion

get_cgi calls

pcVar1 = (char *)get_cgi(0x49f270);

String value@0x49f270 -> need_reboot

• No requirements

pcVar1 = (char *)get_cgi(0x49f188);

String value@0x49f188 -> commit

• No requirements

pcVar1 = (char *)get_cgi(0x49f288);

String value@0x49f288 -> change_action

• Must not be the value gozila_cgi

__s1= (char *)get_cgi(0x49edc0);

String value@0x49dec0 -> submit_button

• Must be a NULL pointer (not defined in the request)

    if (param_7 != (char *)0x0) goto LAB_00421bc0;
    ...
    LAB_00421bc0:
        if (param_6 != (char *)0x0) {
        ...

• param_6 and param_7 must NOT be a NULL pointer

• param_6 must contain the value of either tmBlock.cgi or hndBlock.cgi

1. The following .asp file can be found from the location: /www/index.asp (UART console):

index.asp

</SCRIPT>
</HEAD>
<BODY onload=init() onunload=exit()>
<FORM name=setup method=<% get_http_method(); %> action=apply.cgi>
<input type=hidden name=submit_button>
<input type=hidden name=change_action>
<input type=hidden name=submit_type>
<input type=hidden name=action>
<input type=hidden name=now_proto value='<% nvram_gozila_get("wan_proto"); %>'>
<input type=hidden name=daylight_time value=0>
<input type=hidden name=switch_mode_dhcp value=<% nvram_get("switch_mode_dhcp");%>>
<input type=hidden name=switch_mode value=<% nvram_gozila_get("switch_mode");%>>
<input type=hidden name="switch_ipaddr" value="4">
<input type=hidden name=hnap_devicename value=<% nvram_get("hnap_devicename");%>>
<input type=hidden name="need_reboot" value="0">
<input type=hidden name=user_language>
<input type=hidden name="wait_time" value="0">
<input type=hidden name=dhcp_start value=<% nvram_get("dhcp_start");%>>
<% support_invmatch("HNAP_SPEC_V12_SUPPORT", "1", "<!--"); %>
<input type=hidden name=dhcp_start_conflict value=0>
<% support_invmatch("HNAP_SPEC_V12_SUPPORT", "1", "-->"); %>
<input type=hidden name="lan_ipaddr" value="4">
<input type=hidden name=ppp_demand_pppoe value="9">
<input type=hidden name=ppp_demand_pptp value="9">
<input type=hidden name=ppp_demand_l2tp value="9">
<input type=hidden name=ppp_demand_hb value="9">
<input type=hidden name=wan_ipv6_proto>
<% nvram_invmatch("wan_ipv6_proto", "tunnel", "<!--"); %>
<input type=hidden name=tunnel_status value="connecting">
<% nvram_invmatch("wan_ipv6_proto", "tunnel", "-->"); %>
...

From the index.asp file, we can identify a few potential HTTP parameters:

• submit_button

• change_action

• submit_type

• action

• etc.

6.1.2 Possible HTTP POST payload

POST /apply.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Authorization: Basic [Auth]

// ...POST_PARAMETERS HERE

POST parameter values

As we understand from the analysis before, we have to set the following values in order to control the flow in our way:

1. change_action

• Must NOT be equal to the value gozila_cgi

1. submit_button

• Must be a NULL pointer (not defined)

1. param_6

• Likely taken from the action parameter

• Must NOT be a NULL pointer

  • Either tmBlock.cgi or hdnBlock.cgi

1. param_7

• Likely taken from the submit_type parameter

• Must NOT be a NULL pointer

  • Can be an empty string

change_action=&action=tmBlock.cgi&submit_type=&url=[BUFFER OVERFLOW PAYLOAD]

6.2 GDB, gdbserver

...

6.3 Further analysis (to confirm the HTTP POST payload)

1. Network analysis

It is likely that the index.asp file is loaded whenever a request is sent to the root URL of the webpage on port 80. We know that there exist a form element that calls the apply.cgi route, which triggers the apply_cgi function

1.1 Manually send form request

We can manually send a form request, and use the following methods to analyze the HTTP traffic to understand the parameters and values involved

a. Web browser network tool

b. Burp suite proxy

• From the web browser: configure the HTTP proxy to point to the address of a machine (on the same LAN) running a Burp server

• We are now able to modify the HTTP request on the go

1.2 Further analysis

1. Perform a recursive search (eg. grep) to find all matching patterns for the files in the /www directory:

• Other form elements

• Likely indication of HTTP parameters that relates to param_6 and param_7

• For better understanding of the source code

2. Analyis in Ghidra

2.2 Search for value "apply_cgi"

• From header tab: Search

a. Search "For Strings..."

b. Search "For Direct References"

c. Search "Program Text"

d. Search "Memory"

e. XREFs

• Finding all references to the apply_cgi function

• Right click on function name -> References -> Find References to apply_cgi

The only useful reference is found as a DATA from the router_upgrade function

• The apply_cgi function itself is not even called within this function

2.3 Search for value "apply.cgi"

• From header tab: Search

a. Search "For Strings..."

• Section under the .rodata

b. Search "For Direct Reference

• None found

c. Search "Program Text"

• None found

d. Search "Memory"

...

e. XREFs

...

3. Google dork

We can perform a Google dork to discover other vulnerabilities found on Linksys router for the httpd binary, specifically for any.cgi functions:

linksys httpd "cve" "*.cgi"
linksys httpd "cve" "apply.cgi"

...