| 标题 | dromara mayfly-go 1.2.11 to 1.11.5 OS Command Injection |
|---|
| 描述 | OS command injection in the machine script feature of mayfly-go 1.2.11 through
1.11.5 allows an account holding only the machine:script:run permission to
execute arbitrary commands on a machine it is authorized to use, escaping the
"execute admin-defined script templates only" boundary.
The run endpoint GET /api/machines/scripts/:scriptId/:ac/run accepts a "params"
JSON query parameter. Values are substituted into the stored shell template
with Go text/template and the result is executed over SSH without any shell
escaping or quoting (server/internal/machine/api/machine_script.go,
RunMachineScript): script = TemplateParse(ms.Script, params); cli.Run(script).
POC (verified on v1.11.5, isolated local environment):
1. Admin saves script on machine test-server: "echo copying {{.filename}}".
2. Account lowpriv has machine:script:run but NOT machine:script:save, and is
tag-authorized for test-server only.
3. lowpriv requests:
GET /api/machines/scripts/<scriptId>/test-server/run
?params={"filename":"x; touch /tmp/mayfly_poc_inject"}
Response: {"code":200,"msg":"success","data":"copying x\n"} and
/tmp/mayfly_poc_inject exists inside the machine container. Any command
executes with the privileges of the configured SSH user.
The same account is correctly denied on machines outside its tag authorization,
confirming this is injection into the template mechanism, not a tag bypass.
Additionally GetCliByAc runs before the CanAccess check in the same function,
so unauthorized requests still trigger a real SSH connection attempt.
Templating introduced in commit be00b90c (2022-09-09); first affected release
v1.2.11 (2022-09-22). Suggested CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
(8.8 High). CWE-78.
Vendor contact (CVE prerequisite): the maintainer was contacted privately on
2026-08-21 (public commit address); no response. PR #129 requesting GitHub
Private Vulnerability Reporting was left unanswered for four months. |
|---|
| 来源 | ⚠️ https://gist.github.com/xufengnian/b95662ba0d8881cfc5ba0bb99cbfc086 |
|---|
| 用户 | Guyuelanmin (UID 100728) |
|---|
| 提交 | 2026-08-21 11時25分 (28 日前) |
|---|
| 管理 | 2026-09-17 16時06分 (27 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 406447 [Dromara mayfly-go 直到 1.11.5 Machine Script Feature machine_script.go RunMachineScript params 权限提升] |
|---|
| 积分 | 20 |
|---|