EUVD-2025-21031
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Description
An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.
Analysis
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/save.lsp. Attackers can send crafted PUT requests with arbitrary Lua os.execute() code that is persisted on disk and executed, achieving remote code execution on the embedded web server.
Technical Context
The examples/save.lsp endpoint accepts PUT requests that write Lua code to disk. The endpoint is unauthenticated and does not validate the content. An attacker can inject Lua code containing os.execute() calls that execute system commands. Because the code is persisted, the backdoor survives server restarts.
Affected Products
['Mako Server 2.5', 'Mako Server 2.6']
Remediation
Remove the examples/ directory from production Mako deployments. Disable the save.lsp endpoint. Restrict Mako Server access to trusted networks. Audit saved Lua files for injected code.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today