| शीर्षक | radareorg radare2 up to 6.2.2 OS Command Injection |
|---|
| विवरण | A vulnerability was found in radareorg radare2 up to 6.2.2. The affected component is the built-in HTTP server (/cmd/ endpoint) in libr/core/rtr_http.inc.c, used by the =h command, r2 -c=h and sessions spawned by r2agent.
The /cmd/ endpoint executes radare2 commands taken from the HTTP request path. The option http.sandbox (default true) is meant to prevent OS command execution from HTTP requests, and http.auth is false by default. The sandbox can be bypassed in two ways: (1) a command starting with ':' is passed directly to r_core_cmd0() and never enters the cmdstr() wrapper that enables cfg.sandbox; (2) a command starting with '!' enters cmdstr() but is routed through r_core_cmd_str_pipe() in libr/core/cmd.c, which disables the sandbox in-process. Either path reaches the '!!' shell-escape handler and executes arbitrary OS commands.
This leads to OS command injection and remote code execution as the user running radare2. With the default localhost bind the attack can be carried out through cross-site request forgery from a web page the victim visits; when http.bind=public is set or r2agent runs with -a, the attack can be launched directly over the network without authentication.
CWE-78 (OS Command Injection), secondary CWE-693 (Protection Mechanism Failure).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.1) for the default localhost configuration; 9.8 when the server is bound publicly.
The vendor was informed through a public GitHub issue (radareorg/radare2#26861). No fix is known at this time. No CVE has been assigned.
Product: https://github.com/radareorg/radare2 |
|---|
| स्रोत | ⚠️ https://github.com/radareorg/radare2/issues/26861 |
|---|
| उपयोगकर्ता | lijunjie (UID 101496) |
|---|
| सबमिशन | 01/10/2026 12:59 PM (18 दिन पहले) |
|---|
| संयम | 18/10/2026 03:58 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421756 [radareorg radare2 6.2.0/6.2.2 HTTP Sandbox Policy libr/core/rtr_http.inc.c r_core_cmd_str_pipe अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|