OS Command Injection in Corget GpsDget

Corget GpsDget version 2_3.2 contains an OS command injection vulnerability within its PTTServer HTTP service. The flaw resides in the handling of the 'Target' header during a POST request to the 'SendEmail' method. Analysis of the HttpHandler.cpp source code reveals that user-supplied input from the 'Target' header is insecurely concatenated into a system() call without proper sanitization.

This vulnerability allows unauthenticated remote attackers to inject arbitrary shell commands. Because the service executes these commands with root privileges, exploitation results in full system compromise. The issue was identified in GpsDget version 2_3.2 (build 2020-09-01) of the Gps2.0 product line. Defenders should note that this vulnerability has an active public proof-of-concept exploit available (EDB-52631), which specifically targets the PTTServer component.

Attack Chain

1. Attacker performs reconnaissance to identify systems running the PTTServer service via public exposure.
2. Attacker crafts a malicious HTTP POST request to the target web service.
3. The request includes the 'Method' header set to 'SendEmail'.
4. The request includes a malicious payload in the 'Target' header containing shell metacharacters (e.g., x;<cmd>;).
5. The PTTServer application parses the headers and passes the 'Target' value directly to a system() call.
6. The underlying operating system executes the injected shell command as the root user.
7. Attacker achieves persistent access, data exfiltration, or further lateral movement from the compromised host.

Impact

Successful exploitation grants an unauthenticated attacker full root-level control over the target system. This allows for total compromise of the affected device, including data theft, installation of backdoors, or use of the device in further attacks. As this service is often used in GPS and PTT infrastructure, this vulnerability represents a significant threat to internal operational systems.

Recommendation

Prioritize the identification of all internet-facing instances of Corget GpsDget and restrict access to the PTTServer interface. If patching is unavailable, implement network-level egress filtering and proxy inspection to block HTTP requests containing suspicious shell metacharacters in the 'Target' header. Monitor system logs for unexpected execution of system utilities or shell commands originating from the GpsDget process or user.