提出 #925586: WebMap 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 (CWE-78,CWE-306): OS Command Injection + Missing Authentication

WebMap is an open-source web-based dashboard for managing and visualizing Nmap scan results, deployed via Docker. It provides a graphical interface to run network scans, view results, and manage scan history. The project has over 100,000 Docker Hub downloads, 1,100+ GitHub stars, and ~300 forks.

WebMap through commit 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 contains an unauthenticated OS command injection vulnerability in the POST /api/v1/nmap/scan/new endpoint (source: functions_nmap.py, function: nmap_newscan()). The params parameter is validated with a Python regex that includes \s. Because the validated value is passed directly to subprocess.Popen() with shell=True, an injected newline terminates the nmap argument string, bypassing validation and executing arbitrary shell commands as root inside the container.

The default Docker deployment exposes the service on all interfaces via -p 8000:8000. Users following the official instructions are guaranteed to expose the vulnerable service publicly. 

This bug has been present since 2019 and it's fixed in commit 3d52f65803a2716bff14d938352c6fef45b0cfb6

Requesting via maintainer attempt:
A GitHub Security Advisory (GHSA-rpg3-65vx-ffwm) was submitted to the repository maintainer (SabyasachiRana/WebMap) on GitHub.

The maintainer removed me as a collaborator, and closed the advisory without publishing it or giving credits or requesting a CVE assignment from GitHub CNA, citing that "the application is intended for localhost use only. and it is written in README."

Their dismissal is technically invalid: the official repository deployment instructions in the same README is exposing the application to internet by default, which is directly contradicting the maintainer claim and exposing the service publicly. Also, project that shall run on localhost shouldn't be vulnerable to unauthenticated remote code execution.

Later at the same day, they have patched the vulnerability silently on the following commit without giving any credits.
Any version before this commit is vulnerable ( so, this is the patch commit ):
https://github.com/SabyasachiRana/WebMap/commit/3d52f65803a2716bff14d938352c6fef45b0cfb6

For example this commit is vulnerable :
https://github.com/SabyasachiRana/WebMap/commit/8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25

As the GHSA advisory haven't been published and closed, you can't reach it, however here is the proof :

GitHub Advisory Proof Screenshot :
https://raw.githubusercontent.com/CalledSTRIKER/CalledSTRIKER-gitbook/refs/heads/main/security-research/2026-05-30_12-29.png

Proof of publicly exposed vulnerable WebMap instances via Shodan :
https://raw.githubusercontent.com/CalledSTRIKER/CalledSTRIKER-gitbook/refs/heads/main/security-research/600453906-18a4bc9d-fdaa-4c6d-9afd-a4aabaf12fbf.png

CVSS v4.0: 9.3 (Critical)

WebMap Link:
https://github.com/SabyasachiRana/WebMap

Credits:
Sultan Bazhaer - Security Researcher

Note:
- I submitted an issue alerting the users about a critical vulnerability without telling technical details but the maintainer deleted it and blocked me.
- The maintainer doesn't use release tags, they directly push to the master branch so I needed to put the commits links in the product version section.

• ソース: ⚠️ https://calledstriker.gitbook.io/blog/security-research/webmap
• ユーザー: calledstriker (UID 100528)
• 送信: 2026年08月12日 09:09 (1 月 ago)
• モデレーション: 2026年09月14日 07:06 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403395 [SabyasachiRana WebMap 迄 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 New Nmap Scan functions_nmap.py nmap_newscan params 特権昇格]
• ポイント: 20