| タイトル | Sangfor Operation and Maintenance Security Management System V3 3.0.13 20251211 Unauthenticated RCE |
|---|
| 説明 | A critical unauthenticated Remote Command Execution vulnerability exists in Sangfor OSM's login-related endpoint /fort/portal_login.
The vulnerable logic is located in com.sbr.fort.foreignDP.DpLoginController. The controller receives the raw HTTP request body as a string, passes it to decryption(String req), and then builds a shell command by concatenating the request body into an echo pipeline:
echo -n '<cleaned request body>' | bash /usr/local/bin/aes256.sh decrypt -p "<password>"
The command is then executed through ShellExecutor.dpExe(cmds). Unlike the normal ShellExecutor.exe() path, dpExe() does not call ShellExecutor.clean(). It sends the command directly to the local or remote shell executor, which ultimately runs it through /bin/bash -c.
Because /portal_login is a login-related endpoint and the deployed filters contain broad login URI allow rules, the vulnerable command construction can be reached before normal authentication. The local DpLoginController.clean() function attempts blacklist-style shell escaping, but blacklist escaping is not a reliable security boundary for shell commands. |
|---|
| ソース | ⚠️ https://github.com/lkua-1/cve/issues/1 |
|---|
| ユーザー | Yuanji Wanshu (UID 98573) |
|---|
| 送信 | 2026年06月09日 18:13 (2 月 ago) |
|---|
| モデレーション | 2026年08月03日 12:52 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385562 [Sangfor Operation and Maintenance Security Management System Login Endpoint /fort/portal_login com.sbr.fort.foreignDP.DpLoginController 特権昇格] |
|---|
| ポイント | 20 |
|---|