# Read-Only user can execute arbitraty shell commands on AirOS

Read-only AirOS user runs a speed test against an attacker server whose Set-Cookie header injects shell commands via unsanitized session_key, achieving RCE.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: rbran
- Disclosed: 2016-08-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/128750
- Library page: https://bugbountylibrary.com/r/h1%3A128750
- Tags: area:devices domain:iot impact:rce kind:bounty platform:hackerone sev:high tech:php technique:incomplete-fix vuln:command-injection vuln:rce

**Target:** AirOS remote speed-test client (remote.inc parseHeaders/doLogin)
**Root cause:** parseHeaders extracts the Set-Cookie name into $session_key without sanitization; doLogin concatenates it into a shell command passed to exec().
**Steps:**
1. Start attacker server returning a malicious cookie: `echo -en "HTTP/1.1 200 OK\r\nSet-Cookie: AIROS_`reboot`=12345678901234567890123456789012;\r\nContent-Length: 1\r\nContent-Type: text/html\r\n\r\nA" | ncat -l -p 8080`
2. As a read-only user, trigger the speed test against the attacker host, e.g. `http://192.168.1.100:8080`
3. parseHeaders stores the backtick payload in $session_key; doLogin builds `$cmd $session_str -c $cfgfile $url` and exec() runs it
**How found:** Noticed the prior fix (#119317) only covered client-side data; reviewed remote.inc and saw parseHeaders trusts server-supplied headers, then traced session_key into buildCookieStr and exec().
**Exploitation:** Attacker controls the speed-test peer; its Set-Cookie name is captured into session_key and concatenated into the exec() command line, so backticks execute arbitrary shell commands on the router as the web process.
**Insight:** When a fix sanitizes one data path, check the symmetric server-side path: here the same cookie-parsing logic trusted the remote peer's response headers, so a user-controlled speed-test target becomes an injection vector.