KOReader running on BQ/Fnac devices

[Cuikis]

Originally Posted by tx4man

Hello everyone,

I'm not sure if anyone mentioned this before, but the reader's stock web browser has a vulnerability that allows you to write to /mnt/private directly. So there's no need to bother with serial a COM adapter and disassemble your device.

You just need to run your own web server to download the "hackers_e60q22_ok" authorisation marker from the webserver and take advantage of the Content-Disposition header, and the parent directory ("..") descriptor.

So if a regular download from the webserver without setting up this response header would save your file at /mnt/public/file, in this case we would set the header to /../../private/file to esentially write to /mnt/private:

Content-Disposition: attachment; filename="/mnt/public/randomfolder/../../private/hackers_e60q22_ok"

I've published my findings to https://github.com/x4m4n/bq-cervantes3-offline-unlock, if anyone is interested in following this method. There you'll also find a python3 server preconfigured and ready to go for you to take advantage of this flaw. It's honestly very easy and fast.

Thanks you very much, I am going to try this with my BQ Cervantes Fnac Touch light to install Koreader, I hope it works.

[Cuikis]

Originally Posted by tx4man

Hello everyone,

I'm not sure if anyone mentioned this before, but the reader's stock web browser has a vulnerability that allows you to write to /mnt/private directly. So there's no need to bother with serial a COM adapter and disassemble your device.

You just need to run your own web server to download the "hackers_e60q22_ok" authorisation marker from the webserver and take advantage of the Content-Disposition header, and the parent directory ("..") descriptor.

So if a regular download from the webserver without setting up this response header would save your file at /mnt/public/file, in this case we would set the header to /../../private/file to esentially write to /mnt/private:

Content-Disposition: attachment; filename="/mnt/public/randomfolder/../../private/hackers_e60q22_ok"

I've published my findings to https://github.com/x4m4n/bq-cervantes3-offline-unlock, if anyone is interested in following this method. There you'll also find a python3 server preconfigured and ready to go for you to take advantage of this flaw. It's honestly very easy and fast.

I get the bq_download_probe file with the correct message and size. But when I press Write the Cervantes 3 authorization marker, and insert an empty microsd, I don't get the Device already authorised for hackers firmware installation message.

I understand that it should work in a different way as my device is older. Can you tell me how do you know what should be write and where in your version?

Thanks again for all