| タイトル | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| 説明 | SxDevOps AIOps MCP STDIO server management passes the user-controlled endpoint_or_command field directly to subprocess.Popen() via shlex.split() without any validation or sanitization. When the MCP session is initialized via the test_connection API, the injected command executes on the backend server with Django process privileges. Additionally, auth_config.env allows setting arbitrary environment variables including dangerous ones like LD_PRELOAD, PATH, and PYTHONPATH. The default hardcoded superadmin credentials (admin/Admin@123456) displayed on the login page make this trivially exploitable.
Vulnerable code in backend/aiops/services.py lines 14159-14178:
if server.server_type == "stdio":
cmd = shlex.split(server.endpoint_or_command, posix=False)
process = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=auth_config.get("env", None))
Attack chain:
1. Login with hardcoded default credentials admin/Admin@123456
2. Create MCP STDIO server with endpoint_or_command = "cmd /c whoami 1>&2"
3. Trigger test_connection to execute the injected command
4. Command output is returned in the API response message field
Impact: Complete server compromise with RCE under Django process privileges (observed as Windows Administrator account), enabling full credential extraction and lateral movement to all managed hosts via plaintext SSH passwords stored in the database. |
|---|
| ソース | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| ユーザー | _lxf (UID 63911) |
|---|
| 送信 | 2026年08月24日 04:43 (27 日 ago) |
|---|
| モデレーション | 2026年09月19日 12:15 (26 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 407924 [aiyiyi121 SxDevOps 1.0/1.1 MCP STDIO Server Management services.py subprocess.Popen endpoint_or_command 特権昇格] |
|---|
| ポイント | 20 |
|---|