# Read-Only user can execute arbitraty shell commands on AirOS

Read-only AirOS user injects shell commands via unsanitized target parameter in sptest_action.cgi, achieving command execution on the router.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: rbran
- Disclosed: 2016-08-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/119317
- Library page: https://bugbountylibrary.com/r/h1%3A119317
- Tags: area:devices domain:iot impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:command-injection vuln:rce

**Target:** sptest_action.cgi CGI endpoint (sptest.inc)
**Root cause:** The target parameter is concatenated directly into an exec() shell string in sptest.inc:46 without escaping, allowing shell metacharacter injection.
**Steps:**
1. Authenticate as a read-only user and obtain a valid airosid session value.
2. Send `GET /sptest_action.cgi?ticket=426&action=start&target=192.168.0.100%3Btouch%20/tmp/vulnerable%3B&port=80&airosid=<valid>&_=1456685928091`.
3. The injected `;touch /tmp/vulnerable;` executes via exec() in sptest.inc:46.
**How found:** Researcher reviewed the CGI source (sptest.inc) and noticed the target parameter was concatenated into an exec() call without escaping.
**Exploitation:** A read-only authenticated user supplies a target value containing shell metacharacters; the CGI passes it unescaped to exec(), running arbitrary commands as the web server user on the router.
**Insight:** Low-privilege web UI accounts on embedded router firmware often reach CGI handlers that shell out; grep firmware CGI sources for exec()/system() with request params and test read-only roles against them.