| Título | aiyiyi121 SxDevOps 1.1 Command Injection |
|---|
| Descrição | The TASK_RUN_COMMAND task type in SxDevOps passes payload.command directly to paramiko.SSHClient.exec_command() without any filtering or escaping. While the TASK_SERVICE_STATUS branch properly uses shlex.quote() for sanitization, this branch has zero filtering. Attackers with ops.task.execute permission can chain arbitrary commands using shell metacharacters (; && ||) to execute them on all SSH-managed target hosts. AIOps-generated tasks (TRIGGER_SOURCE_AIOPS) share the same vulnerability, expanding the attack surface through LLM prompt injection.
Vulnerable code in backend/ops/host_tasks.py lines 293, 589:
elif task_type == "TASK_RUN_COMMAND":
command = task_payload.get("command", "")
stdin, stdout, stderr = ssh_client.exec_command(command)
Compare with the properly sanitized TASK_SERVICE_STATUS branch:
service_name = shlex.quote(service_name)
command = f"systemctl status {service_name}"
Impact: Remote Code Execution on all SSH-managed hosts, enabling lateral movement across the entire infrastructure under management. |
|---|
| Fonte | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| Utilizador | _lxf (UID 63911) |
|---|
| Submissão | 24/08/2026 04h45 (há 27 dias) |
|---|
| Moderação | 19/09/2026 12h15 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 407925 [aiyiyi121 SxDevOps 1.0/1.1 TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|