| शीर्षक | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| विवरण | The TASK_RUN_COMMAND task type in SxDevOps passes payload.command directly to paramiko.SSHClient.exec_command() without any filtering or escaping. While the TASK_SERVICE_STATUS branch properly uses shlex.quote() for sanitization, this branch has zero filtering. Attackers with ops.task.execute permission can chain arbitrary commands using shell metacharacters (; && ||) to execute them on all SSH-managed target hosts. AIOps-generated tasks (TRIGGER_SOURCE_AIOPS) share the same vulnerability, expanding the attack surface through LLM prompt injection.
Vulnerable code in backend/ops/host_tasks.py lines 293, 589:
elif task_type == "TASK_RUN_COMMAND":
command = task_payload.get("command", "")
stdin, stdout, stderr = ssh_client.exec_command(command)
Compare with the properly sanitized TASK_SERVICE_STATUS branch:
service_name = shlex.quote(service_name)
command = f"systemctl status {service_name}"
Impact: Remote Code Execution on all SSH-managed hosts, enabling lateral movement across the entire infrastructure under management. |
|---|
| स्रोत | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| उपयोगकर्ता | _lxf (UID 63911) |
|---|
| सबमिशन | 24/08/2026 04:45 AM (27 दिन पहले) |
|---|
| संयम | 19/09/2026 12:15 PM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407925 [aiyiyi121 SxDevOps 1.0/1.1 TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|