Hashbrown Cms
Monthly
OS command injection in HashBrown CMS through version 1.4.6 allows any authenticated user with project configuration access to execute arbitrary OS commands on the server by embedding shell metacharacters in the Git deployer's branch field - an attack surface left exposed by the incomplete remediation of CVE-2020-6948, which fixed single-quote injection in git clone fields but not the branch parameter in the git checkout invocation. GitDeployer.validate() blocks only single-quote characters, leaving semicolons, pipes, ampersands, backticks, and command substitution syntax freely injectable; once planted, the malicious branch value fires automatically on every subsequent deployer operation (media upload, content save) without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the attack is mechanistically trivial given the complete absence of metacharacter filtering.
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope to execute arbitrary shell commands on the server by exploiting a discrepancy between two filename-parsing functions. The MIME-type filter in getMIMEType() truncates filenames at the first '?' character - accepting 'x.jpg?$(command)' as a valid image - while Node.js Path.extname() does not truncate at '?', allowing the full malicious suffix to flow unescaped into a shell exec() call inside the thumbnail generation routine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and requires only low-privilege access, making it a meaningful risk for any internet-accessible deployment.
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in HashBrown CMS before 1.3.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
OS command injection in HashBrown CMS through version 1.4.6 allows any authenticated user with project configuration access to execute arbitrary OS commands on the server by embedding shell metacharacters in the Git deployer's branch field - an attack surface left exposed by the incomplete remediation of CVE-2020-6948, which fixed single-quote injection in git clone fields but not the branch parameter in the git checkout invocation. GitDeployer.validate() blocks only single-quote characters, leaving semicolons, pipes, ampersands, backticks, and command substitution syntax freely injectable; once planted, the malicious branch value fires automatically on every subsequent deployer operation (media upload, content save) without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the attack is mechanistically trivial given the complete absence of metacharacter filtering.
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope to execute arbitrary shell commands on the server by exploiting a discrepancy between two filename-parsing functions. The MIME-type filter in getMIMEType() truncates filenames at the first '?' character - accepting 'x.jpg?$(command)' as a valid image - while Node.js Path.extname() does not truncate at '?', allowing the full malicious suffix to flow unescaped into a shell exec() call inside the thumbnail generation routine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and requires only low-privilege access, making it a meaningful risk for any internet-accessible deployment.
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in HashBrown CMS before 1.3.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.