| 제목 | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| 설명 | The TASK_RUN_COMMAND task type in SxDevOps passes payload.command directly to paramiko.SSHClient.exec_command() without any filtering or escaping. While the TASK_SERVICE_STATUS branch properly uses shlex.quote() for sanitization, this branch has zero filtering. Attackers with ops.task.execute permission can chain arbitrary commands using shell metacharacters (; && ||) to execute them on all SSH-managed target hosts. AIOps-generated tasks (TRIGGER_SOURCE_AIOPS) share the same vulnerability, expanding the attack surface through LLM prompt injection.
Vulnerable code in backend/ops/host_tasks.py lines 293, 589:
elif task_type == "TASK_RUN_COMMAND":
command = task_payload.get("command", "")
stdin, stdout, stderr = ssh_client.exec_command(command)
Compare with the properly sanitized TASK_SERVICE_STATUS branch:
service_name = shlex.quote(service_name)
command = f"systemctl status {service_name}"
Impact: Remote Code Execution on all SSH-managed hosts, enabling lateral movement across the entire infrastructure under management. |
|---|
| 원천 | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| 사용자 | _lxf (UID 63911) |
|---|
| 제출 | 2026. 08. 24. AM 04:45 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 19. PM 12:15 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 407925 [aiyiyi121 SxDevOps 1.0/1.1 TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command 권한 상승] |
|---|
| 포인트들 | 20 |
|---|