| 标题 | Sangfor Operation and Maintenance Security Management System V3 3.0.13 20251211 Unauthenticated RCE |
|---|
| 描述 | A critical unauthenticated Remote Command Execution vulnerability exists in Sangfor OSM's login-related endpoint /fort/portal_login.
The vulnerable logic is located in com.sbr.fort.foreignDP.DpLoginController. The controller receives the raw HTTP request body as a string, passes it to decryption(String req), and then builds a shell command by concatenating the request body into an echo pipeline:
echo -n '<cleaned request body>' | bash /usr/local/bin/aes256.sh decrypt -p "<password>"
The command is then executed through ShellExecutor.dpExe(cmds). Unlike the normal ShellExecutor.exe() path, dpExe() does not call ShellExecutor.clean(). It sends the command directly to the local or remote shell executor, which ultimately runs it through /bin/bash -c.
Because /portal_login is a login-related endpoint and the deployed filters contain broad login URI allow rules, the vulnerable command construction can be reached before normal authentication. The local DpLoginController.clean() function attempts blacklist-style shell escaping, but blacklist escaping is not a reliable security boundary for shell commands. |
|---|
| 来源 | ⚠️ https://github.com/lkua-1/cve/issues/1 |
|---|
| 用户 | Yuanji Wanshu (UID 98573) |
|---|
| 提交 | 2026-06-09 18時13分 (2 月前) |
|---|
| 管理 | 2026-08-03 12時52分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 385562 [Sangfor Operation and Maintenance Security Management System Login Endpoint /fort/portal_login com.sbr.fort.foreignDP.DpLoginController 权限提升] |
|---|
| 积分 | 20 |
|---|