rConfig Arbitrary File Upload Scanner

rConfig is a popular open-source configuration management tool used by network administrators and IT professionals to automate device configuration tasks, monitor network changes, and maintain consistent network configuration settings. It provides a centralized platform for managing various network configurations efficiently, particularly for network devices like routers and switches. rConfig is widely deployed in corporate IT environments, telecommunications, and data centers to streamline network management processes and enable quick responses to configuration changes.

The arbitrary file upload vulnerability in rConfig arises due to insufficient validation of uploaded files in the file upload functionality. This flaw allows an attacker to bypass authentication and upload files without proper restrictions on file types or content. The vulnerability is particularly dangerous because it can be exploited remotely without requiring any prior access, making it a critical security issue for any organization using affected versions of rConfig.

Specifically, the vulnerability exists in the file upload endpoint used for importing device configurations. The vulnerable parameter is the file input field in the import function, which does not properly check the file extension or MIME type. An attacker can craft a malicious PHP file disguised as a legitimate configuration file and upload it to the server. Once uploaded, the attacker can access this file via a web browser and execute arbitrary PHP code on the server.

If exploited, this vulnerability can lead to full compromise of the rConfig server, including unauthorized access to sensitive configuration data, network credentials, and the ability to pivot to other systems within the network. Attackers can also use the compromised server as a launch point for further attacks, such as deploying ransomware or exfiltrating data. The high CVSS score of 8.8 reflects the severe impact and ease of exploitation of this vulnerability.