UpSnap <=5.3.5 未认证提权链致Root RCE (CVE-2026-49819)

漏洞概述 漏洞名称: UpSnap = 4.4.1, = 5.4.0 影响: - 机密性: 高 - 攻击者可以读取所有 PocketBase 容器（包括超级用户密码、完整设备清单、服务器-对-局域网睡眠凭据等所有设置）。 - 完整性: 高 - 超级用户写入每个集合；后 RCE 允许攻击者在任何文件容器中写入，包括 SQLite 数据库和嵌入式前端资产。 - 可用性: 高 - 攻击者可以删除任何文件、表或启用 ，导致所有 LAN 连接的设备的意图关机/重启功能失效。 修复方案 推荐控制措施: - 在 函数中添加一个带外设置令牌请求，该令牌在服务器启动时由 环境变量提供。 - 要求 请求头与 进行比较，以避免时序攻击。 - 如果环境变量未设置，拒绝请求并引导操作员到现有的 CLI，该 CLI 已强制执行本地访问。 验证补丁: - 补丁代码已提供，确保在 中的 函数中立即进行现有集合查找后添加上述控制措施。 POC 代码 ```bash #!/usr/bin/env bash exploit_upsnap.sh Step 4 confirmation harness for UpSnap 5.3.5: POST /api/upsnap/init-superuser is registered without middleware and only refuses when totalSuperusers > 0. On every fresh install the replacement introduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only installer-superuser behavior. The replacement reintroduces exactly the property PocketBase 0.23+ had moved to a console-only installer-superuser behavior. (2024-12-25) to re-enable web-UI setup that PocketBase 0.23+ had moved to a console-only ins

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

UpSnap <=5.3.5 未认证提权链致Root RCE (CVE-2026-49819)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

UpSnap <=5.3.5 未认证提权链致Root RCE (CVE-2026-49819)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！