EUVD-2025-16939
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Lifecycle Timeline
6DescriptionNVD
Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd() in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a Common::safe_execute function that sanitizes all arguments using escapeshellarg() prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.
AnalysisAI
Critical command injection vulnerability in Atheos IDE versions prior to 6.0.4, stemming from improper use of escapeshellcmd() in the Git component that allows argument injection leading to arbitrary command execution. The vulnerability affects Atheos administrators and users on vulnerable versions who can be compromised through a network-based attack requiring high privileges (authenticated admin access). An authenticated attacker with administrative rights can execute arbitrary system commands, potentially leading to complete server compromise, data breaches, and lateral movement within the hosting infrastructure.
Technical ContextAI
The vulnerability exists in /components/codegit/traits/execute.php where the Atheos IDE improperly implements shell command execution using PHP's escapeshellcmd() function. The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) stems from inadequate input sanitization before passing user-controlled arguments to shell execution contexts. While escapeshellcmd() removes special characters that have special meaning to shell, it fails to properly quote/escape individual arguments, allowing attackers to inject additional command arguments. The fix introduced in version 6.0.4 replaces this with escapeshellarg(), which properly quotes each argument individually and escapes any quotes within the argument, preventing argument injection attacks. Atheos (CPE: software:atheos) is a self-hosted, browser-based IDE with Git integration capabilities, making the vulnerable Git component a critical attack surface for authenticated users.
RemediationAI
Upgrade Atheos to version 6.0.4 or later immediately; details: Version 6.0.4 introduces the Common::safe_execute function that uses escapeshellarg() for proper argument sanitization and migrates all vulnerable execution paths to this templated system. Workaround: Restrict administrative access in Atheos; details: Limit the number of accounts with administrator privileges; implement strict access controls and audit logging for admin accounts; use multi-factor authentication if available. Mitigation: Network segmentation and monitoring; details: Restrict network access to Atheos instances to trusted networks only; monitor and log all Git operations and administrative actions; implement intrusion detection for suspicious command patterns. Code-level fix: Manual remediation if immediate patching is not possible; details: Review /components/codegit/traits/execute.php and replace all escapeshellcmd() usage with escapeshellarg() for individual arguments, or implement the Common::safe_execute template function from version 6.0.4.
Share
External POC / Exploit Code
Leaving vuln.today