| Titre | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| Description | The TASK_RUN_COMMAND task type in SxDevOps passes payload.command directly to paramiko.SSHClient.exec_command() without any filtering or escaping. While the TASK_SERVICE_STATUS branch properly uses shlex.quote() for sanitization, this branch has zero filtering. Attackers with ops.task.execute permission can chain arbitrary commands using shell metacharacters (; && ||) to execute them on all SSH-managed target hosts. AIOps-generated tasks (TRIGGER_SOURCE_AIOPS) share the same vulnerability, expanding the attack surface through LLM prompt injection.
Vulnerable code in backend/ops/host_tasks.py lines 293, 589:
elif task_type == "TASK_RUN_COMMAND":
command = task_payload.get("command", "")
stdin, stdout, stderr = ssh_client.exec_command(command)
Compare with the properly sanitized TASK_SERVICE_STATUS branch:
service_name = shlex.quote(service_name)
command = f"systemctl status {service_name}"
Impact: Remote Code Execution on all SSH-managed hosts, enabling lateral movement across the entire infrastructure under management. |
|---|
| La source | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| Utilisateur | _lxf (UID 63911) |
|---|
| Soumission | 24/08/2026 04:45 (il y a 27 jours) |
|---|
| Modérer | 19/09/2026 12:15 (26 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 407925 [aiyiyi121 SxDevOps 1.0/1.1 TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command élévation de privilèges] |
|---|
| Points | 20 |
|---|