Issue 181: Vulnerability in Wavlink router, API exposing system passwords, views on internal APIs
Brief
This week, we have two API vulnerabilities: a command injection vulnerability in the control API of the Wavlink WL-WN531P3 router, and another one on the website of a security regulator in South Africa. In addition, we have views on the management of internal and external APIs, and how the new Lambda Function URLs on AWS enable rapid API development.
Vulnerability: Command injection vulnerability in Wavlink WL-WN531P3 router
This week’s first vulnerability is a command injection vulnerability in an internal API of the Wavlink WL-WN531P3 router. A security researcher discovered an internal admin interface /cgi-bin/adm. cgi that the router UI used to execute arbitrary commands. Unfortunately, this endpoint was vulnerable in several ways:
- The endpoint did not enforce authentication at all — an example of API2:2019 — Broken authentication.