Description
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openspug spug
Default version status: unaffected
0 to ≤ 3.4.0affected
pkg:github/openspug/spugReferences
- https://github.com/openspug/spug/issues/741 ↗
- https://github.com/openspug/spug ↗
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/executors.py ↗
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/views.py ↗
- https://github.com/openspug/spug/commit/97aebf133e1f9cbb35ccebadab1faedfdfe93f42 ↗
- https://www.vulncheck.com/advisories/spug-through-3.4.0-remote-code-execution-via-ping-check ↗