| Titel | OpenSpug Spug 4.0.0 Command Injection |
|---|
| Beschreibung | Spug is an open-source lightweight O&M platform for SMEs. In OpenSpug Spug v3.4.0 and earlier, the monitor address parameter targets[0] of the Ping detection endpoint POST /monitor/test/ is interpolated into a shell command (ping -c 1 -W 3 <addr>) without validation and executed with shell=True on the Spug server. A low-privileged authenticated user with only the Monitoring Center add/edit permission can inject arbitrary commands, obtaining persistent command execution on the Spug platform server (as root in the official Docker deployment) and compromising all hosts it manages. |
|---|
| Quelle | ⚠️ https://github.com/SECWG/CVE/issues/11 |
|---|
| Benutzer | WenGui (UID 82184) |
|---|
| Einreichung | 28.08.2026 10:29 (vor 2 Monaten) |
|---|
| Moderieren | 10.10.2026 15:37 (1 month later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 403272 [OpenSpug bis 3.4.0 /monitor/run_test ping_check erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|