Spug
Monthly
Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the `/monitor/run_test/` HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with `subprocess.run(..., shell=True)`. Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. No public exploit identified at time of analysis, but the vulnerable code path is trivially constructable from public source and the upstream patch commit is publicly visible.
Remote code execution in Spug through v3.4.0 allows authenticated users holding monitor permissions to inject arbitrary OS commands via the `/monitor/run_test/` HTTP endpoint, where user-supplied ping target addresses are interpolated directly into Python f-string shell commands executed with `subprocess.run(..., shell=True)`. Exploitation yields arbitrary command execution as the Spug process user, enabling full server takeover. No public exploit identified at time of analysis, but the vulnerable code path is trivially constructable from public source and the upstream patch commit is publicly visible.