Maxime Rinaudo

A shellcode injection exists in the mercurial handler of the source service. Attackers who can provide a crafted ` service` file can execute arbitrary code as the source service or the local user performing the checkout process.

CWP (Control Web Panel) is susceptible to an unauthenticated remote code execution vulnerability. An attacker with knowledge of a valid, non-root username can exploit this flaw by sending a specially crafted request to the `/admin/loader ajax.php?ajax=filemanager&acc=changePerm` endpoint. The vulnerability resides in the insufficient filtering of the `t total` parameter, allowing shell metacharacters to be injected and executed on the server. This can lead to complete control of the server, including the ability to install backdoors, steal data, and move laterally within the network. Reports indicate active exploitation of this vulnerability, with over 1.8 million potentially vulnerable instances identified. The vulnerability allows attackers to bypass authentication and execute arbitrary commands.

The OBS service obs-service-download url was vulnerable to a command injection issue. An attacker could provide a configuration to the service that allowed executing commands in later steps.