CVE-2026-90770
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.
वीकनेस
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.
संदर्भ
- https://github.com/openspug/spug
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/executors.py
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/views.py
- https://github.com/openspug/spug/commit/97aebf133e1f9cbb35ccebadab1faedfdfe93f42
- https://github.com/openspug/spug/issues/741
- https://www.vulncheck.com/advisories/spug-through-3.4.0-remote-code-execution-via-ping-check
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।