| Titel | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| Beschreibung | SxDevOps AIOps MCP STDIO server management passes the user-controlled endpoint_or_command field directly to subprocess.Popen() via shlex.split() without any validation or sanitization. When the MCP session is initialized via the test_connection API, the injected command executes on the backend server with Django process privileges. Additionally, auth_config.env allows setting arbitrary environment variables including dangerous ones like LD_PRELOAD, PATH, and PYTHONPATH. The default hardcoded superadmin credentials (admin/Admin@123456) displayed on the login page make this trivially exploitable.
Vulnerable code in backend/aiops/services.py lines 14159-14178:
if server.server_type == "stdio":
cmd = shlex.split(server.endpoint_or_command, posix=False)
process = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=auth_config.get("env", None))
Attack chain:
1. Login with hardcoded default credentials admin/Admin@123456
2. Create MCP STDIO server with endpoint_or_command = "cmd /c whoami 1>&2"
3. Trigger test_connection to execute the injected command
4. Command output is returned in the API response message field
Impact: Complete server compromise with RCE under Django process privileges (observed as Windows Administrator account), enabling full credential extraction and lateral movement to all managed hosts via plaintext SSH passwords stored in the database. |
|---|
| Quelle | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| Benutzer | _lxf (UID 63911) |
|---|
| Einreichung | 24.08.2026 04:43 (vor 27 Tagen) |
|---|
| Moderieren | 19.09.2026 12:15 (26 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 407924 [aiyiyi121 SxDevOps 1.0/1.1 MCP STDIO Server Management services.py subprocess.Popen endpoint_or_command erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|