An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb | exploit |
| https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87 | exploit third party advisory |
| https://github.com/stamparm/maltrail | product |
| https://github.com/stamparm/maltrail/issues/19146 | issue tracking |
| https://vulncheck.com/advisories/stamparm-maltrail-rce | third party advisory |