| Titel | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| Beschreibung | The TASK_RUN_COMMAND task type in SxDevOps passes payload.command directly to paramiko.SSHClient.exec_command() without any filtering or escaping. While the TASK_SERVICE_STATUS branch properly uses shlex.quote() for sanitization, this branch has zero filtering. Attackers with ops.task.execute permission can chain arbitrary commands using shell metacharacters (; && ||) to execute them on all SSH-managed target hosts. AIOps-generated tasks (TRIGGER_SOURCE_AIOPS) share the same vulnerability, expanding the attack surface through LLM prompt injection.
Vulnerable code in backend/ops/host_tasks.py lines 293, 589:
elif task_type == "TASK_RUN_COMMAND":
command = task_payload.get("command", "")
stdin, stdout, stderr = ssh_client.exec_command(command)
Compare with the properly sanitized TASK_SERVICE_STATUS branch:
service_name = shlex.quote(service_name)
command = f"systemctl status {service_name}"
Impact: Remote Code Execution on all SSH-managed hosts, enabling lateral movement across the entire infrastructure under management. |
|---|
| Quelle | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| Benutzer | _lxf (UID 63911) |
|---|
| Einreichung | 24.08.2026 04:45 (vor 27 Tagen) |
|---|
| Moderieren | 19.09.2026 12:15 (26 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 407925 [aiyiyi121 SxDevOps 1.0/1.1 TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|