| शीर्षक | vertex-app vertex up to v2026.02.12 OS Command Injection |
|---|
| विवरण | This authenticated OS Command Injection vulnerability in Vertex allows Remote Code Execution because the type query parameter is passed directly into execSync() without sanitization in the log viewer endpoint. An attacker can inject shell metacharacters to execute arbitrary system commands under the application's privileges. Furthermore, since Vertex lacks CSRF protection for this action, an attacker can remotely trigger the exploit by deceiving a logged-in administrator into visiting a malicious URL, potentially leading to a full compromise of the host server. |
|---|
| स्रोत | ⚠️ https://gist.github.com/menelausx/e632faba4014474fcef6a1f541ca3e4e |
|---|
| उपयोगकर्ता | JasperX (UID 97281) |
|---|
| सबमिशन | 03/05/2026 02:59 PM (5 महीनों पहले) |
|---|
| संयम | 05/06/2026 08:34 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 368967 [vertex-app vertex तक 2026.02.12 Log Viewer Endpoint app/model/LogMod.js req.query अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|