White Rabbit Switch full disclosure

17 Jul 2026 - Victor Pasman

DIVD received a vulnerability report about the White Rabbit Switch from CERN. The vulnerabilities were discovered by researcher Tom Wolters of Chapter8.

DIVD is a CVE Numbering Authority (CNA) and has used these rights to assign the following CVEs to the vulnerabilities included in the write-up below:

The rest of this post contains the full technical write-up of the vulnerabilities.

Unauthenticated password disclosure via configuration file read - CVE-2023-22577

Within White Rabbit Switch it’s possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.

The web application exposes a showfile.php endpoint that is used to serve context-sensitive “help pages” for the various configuration screens. The help_id and name GET parameters supplied by the visitor are passed unfiltered into the wrs_display_help() function, defined in functions.php.

One of the branches of wrs_display_help() handles a help_id value of dotconfig, in which case the function reads out the full contents of the application’s configuration file (kconfigfile) and returns it directly to the requester:

else if (!strcmp($help_id, "dotconfig")){
    $message = file_get_contents($GLOBALS['kconfigfile']);
    $message = str_replace("\n", "<br>", $message);
}

No authentication or authorization check is performed before this file is read and returned. As a result, simply requesting the following URL discloses the full configuration file, including the root password hash and SNMP read/write community strings, to any unauthenticated visitor:

https://<URL>/showfile.php?help_id=c8&name=dotconfig

The returned configuration includes lines such as network configuration, hostname, and — most critically — the encrypted/hashed root password (CONFIG_ROOT_PWD_CYPHER) and SNMP community strings.

Suggested actions

Upgrade to White Rabbit Switch version 6.0.2 or later.

Unauthenticated OS command injection via showfile.php - CVE-2023-22581

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application. In the default installation, the webserver runs as the root user, so this results in unauthenticated remote code execution as root.

The same wrs_display_help() function in functions.php contains a second branch, triggered when help_id is set to file, which passes the unfiltered name parameter directly into a shell_exec() call:

else if (!strcmp($help_id, "file")){
    $msg = shell_exec("cat ".$GLOBALS['etcdir'].$name);
    $msg = explode("\n", $msg);
    for($i=0; $i<count($msg); $i++){
        $message .= $i.":  ".$msg[$i]."<br>";
    }
}

Because $name is concatenated directly into the shell command without any sanitization, an attacker can inject arbitrary shell metacharacters. Any command placed between a semicolon (;) and an ampersand (&) in the name parameter will be executed by the underlying system:

https://<URL>/showfile.php?name=txt;whoami&help_id=file

In testing, this returned root as the result of the injected whoami command, confirming the web application (and therefore any injected command) runs with root privileges. This could be leveraged, for example, to change the root password and obtain SSH access to the device.

Suggested actions

Upgrade to White Rabbit Switch version 6.0.2 or later.

Timeline

More information

Last modified: 18 Jul 2026 19:23 CEST