| Titel | radareorg radare2 up to 6.2.2 OS Command Injection |
|---|
| Beschreibung | A vulnerability was found in radareorg radare2 up to 6.2.2. The affected component is the built-in HTTP server (/cmd/ endpoint) in libr/core/rtr_http.inc.c, used by the =h command, r2 -c=h and sessions spawned by r2agent.
The /cmd/ endpoint executes radare2 commands taken from the HTTP request path. The option http.sandbox (default true) is meant to prevent OS command execution from HTTP requests, and http.auth is false by default. The sandbox can be bypassed in two ways: (1) a command starting with ':' is passed directly to r_core_cmd0() and never enters the cmdstr() wrapper that enables cfg.sandbox; (2) a command starting with '!' enters cmdstr() but is routed through r_core_cmd_str_pipe() in libr/core/cmd.c, which disables the sandbox in-process. Either path reaches the '!!' shell-escape handler and executes arbitrary OS commands.
This leads to OS command injection and remote code execution as the user running radare2. With the default localhost bind the attack can be carried out through cross-site request forgery from a web page the victim visits; when http.bind=public is set or r2agent runs with -a, the attack can be launched directly over the network without authentication.
CWE-78 (OS Command Injection), secondary CWE-693 (Protection Mechanism Failure).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.1) for the default localhost configuration; 9.8 when the server is bound publicly.
The vendor was informed through a public GitHub issue (radareorg/radare2#26861). No fix is known at this time. No CVE has been assigned.
Product: https://github.com/radareorg/radare2 |
|---|
| Quelle | ⚠️ https://github.com/radareorg/radare2/issues/26861 |
|---|
| Benutzer | lijunjie (UID 101496) |
|---|
| Einreichung | 01.10.2026 12:59 (vor 17 Tagen) |
|---|
| Moderieren | 18.10.2026 15:58 (17 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 421756 [radareorg radare2 6.2.0/6.2.2 HTTP Sandbox Policy libr/core/rtr_http.inc.c r_core_cmd_str_pipe erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|