This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: reNgine suffers from **OS Command Injection**. π **Consequences**: Attackers can execute arbitrary system commands as **root**.β¦
π‘οΈ **Root Cause**: Improper input validation in `subprocess.check_output`. π **Flaw**: Shell metacharacters are not sanitized in parameters like `nmap_cmd` or `api/tools/waf_detector/?url=`. This allows command chaining.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: reNgine versions **2.0.2 and earlier** (including 2.2.0 mentioned in PoC). π **Component**: The Scan Engine configuration and WAF detector API endpoints.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: Commands run as **root** user. π **Data**: Full read/write access to the server. Hackers can exfiltrate sensitive web app data, install backdoors, or pivot to other internal systems.
Q5Is exploitation threshold high? (Auth/Config)
β οΈ **Threshold**: **Medium**. βοΈ **Requirement**: Attacker needs a **valid session ID** (authenticated). Once logged in, exploitation is trivial via API parameters.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp?**: **Yes**. π **PoC**: Available on GitHub (e.g., `CVE-2023-50094_POC`) and Nuclei templates. Automated tools can leverage these for quick exploitation.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: 1. Check reNgine version. 2. Look for `subprocess` calls in `web/api/views.py`. 3. Scan for `api/tools/waf_detector/?url=` with shell metacharacters (e.g., `; ls`).
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed?**: **Yes**. π οΈ **Patch**: Update to **reNgine 2.1.2 or later**. The commit `edd3c85` addresses the input sanitization issue. Check GitHub releases for the latest secure version.
Q9What if no patch? (Workaround)
π§ **No Patch?**: 1. **Isolate** the instance. 2. **Restrict** access to authenticated users only via WAF/Network ACLs. 3. **Monitor** logs for unusual `subprocess` or `nmap` activity. 4.β¦
π₯ **Urgency**: **High**. π **Priority**: Immediate patching required. Since it grants **root** access and PoCs are public, unpatched instances are at high risk of automated exploitation.