| 제목 | dromara mayfly-go 1.2.11 to 1.11.5 OS Command Injection |
|---|
| 설명 | OS command injection in the machine script feature of mayfly-go 1.2.11 through
1.11.5 allows an account holding only the machine:script:run permission to
execute arbitrary commands on a machine it is authorized to use, escaping the
"execute admin-defined script templates only" boundary.
The run endpoint GET /api/machines/scripts/:scriptId/:ac/run accepts a "params"
JSON query parameter. Values are substituted into the stored shell template
with Go text/template and the result is executed over SSH without any shell
escaping or quoting (server/internal/machine/api/machine_script.go,
RunMachineScript): script = TemplateParse(ms.Script, params); cli.Run(script).
POC (verified on v1.11.5, isolated local environment):
1. Admin saves script on machine test-server: "echo copying {{.filename}}".
2. Account lowpriv has machine:script:run but NOT machine:script:save, and is
tag-authorized for test-server only.
3. lowpriv requests:
GET /api/machines/scripts/<scriptId>/test-server/run
?params={"filename":"x; touch /tmp/mayfly_poc_inject"}
Response: {"code":200,"msg":"success","data":"copying x\n"} and
/tmp/mayfly_poc_inject exists inside the machine container. Any command
executes with the privileges of the configured SSH user.
The same account is correctly denied on machines outside its tag authorization,
confirming this is injection into the template mechanism, not a tag bypass.
Additionally GetCliByAc runs before the CanAccess check in the same function,
so unauthorized requests still trigger a real SSH connection attempt.
Templating introduced in commit be00b90c (2022-09-09); first affected release
v1.2.11 (2022-09-22). Suggested CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
(8.8 High). CWE-78.
Vendor contact (CVE prerequisite): the maintainer was contacted privately on
2026-08-21 (public commit address); no response. PR #129 requesting GitHub
Private Vulnerability Reporting was left unanswered for four months. |
|---|
| 원천 | ⚠️ https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086 |
|---|
| 사용자 | Guyuelanmin (UID 100728) |
|---|
| 제출 | 2026. 08. 21. AM 11:25 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 17. PM 04:06 (27 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 406447 [Dromara mayfly-go 까지 1.11.5 Machine Script Feature machine_script.go RunMachineScript params 권한 상승] |
|---|
| 포인트들 | 20 |
|---|