| शीर्षक | Sangfor Operation and Maintenance Security Management System V3 3.0.13 20251211 Unauthenticated RCE |
|---|
| विवरण | A critical unauthenticated Remote Command Execution vulnerability exists in Sangfor OSM's login-related endpoint /fort/portal_login.
The vulnerable logic is located in com.sbr.fort.foreignDP.DpLoginController. The controller receives the raw HTTP request body as a string, passes it to decryption(String req), and then builds a shell command by concatenating the request body into an echo pipeline:
echo -n '<cleaned request body>' | bash /usr/local/bin/aes256.sh decrypt -p "<password>"
The command is then executed through ShellExecutor.dpExe(cmds). Unlike the normal ShellExecutor.exe() path, dpExe() does not call ShellExecutor.clean(). It sends the command directly to the local or remote shell executor, which ultimately runs it through /bin/bash -c.
Because /portal_login is a login-related endpoint and the deployed filters contain broad login URI allow rules, the vulnerable command construction can be reached before normal authentication. The local DpLoginController.clean() function attempts blacklist-style shell escaping, but blacklist escaping is not a reliable security boundary for shell commands. |
|---|
| स्रोत | ⚠️ https://github.com/lkua-1/cve/issues/1 |
|---|
| उपयोगकर्ता | Yuanji Wanshu (UID 98573) |
|---|
| सबमिशन | 09/06/2026 06:13 PM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 12:52 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385562 [Sangfor Operation and Maintenance Security Management System Login Endpoint /fort/portal_login com.sbr.fort.foreignDP.DpLoginController अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|