This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: OS Command Injection in Sangfor OMS. 💥 **Consequences**: Attackers can execute arbitrary system commands, leading to full server compromise, data theft, or service disruption.
Q2Root Cause? (CWE/Flaw)
🛡️ **Root Cause**: CWE-78 (OS Command Injection). 🐛 **Flaw**: Improper handling of the `sessionPath` parameter in the `/isomp-protocol/protocol/getHis` HTTP POST endpoint.
Q3Who is affected? (Versions/Components)
🏢 **Vendor**: Sangfor (China). 📦 **Product**: Operation and Maintenance Management System. ⚠️ **Affected**: Versions **3.0.8 and earlier**.
Q4What can hackers do? (Privileges/Data)
👑 **Privileges**: High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 📂 **Data**: Full access to Confidentiality, Integrity, and Availability. Essentially **Root/Admin access**.
Q5Is exploitation threshold high? (Auth/Config)
🔓 **Threshold**: **LOW**. 🌐 **Network**: Remote (AV:N). 🚫 **Auth**: No privileges required (PR:N). 🤝 **UI**: No user interaction needed (UI:N). Easy to exploit remotely.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔍 **Exploit Status**: Public references exist on GitHub and VDB. 📝 **Details**: Issue #11 on GitHub and VDB-340345 indicate active tracking and potential PoC availability.
Q7How to self-check? (Features/Scanning)
🔎 **Self-Check**: Scan for Sangfor OMS endpoints. 📡 **Target**: Look for HTTP POST requests to `/isomp-protocol/protocol/getHis`.…
🛠️ **Fix**: Upgrade to a version **newer than 3.0.8**. 📢 **Official**: Check Sangfor’s official security advisory for the specific patched version.
Q9What if no patch? (Workaround)
🚧 **Workaround**: If patching is delayed, **block external access** to the OMS interface. 🛑 **Mitigate**: Restrict network access to the `/isomp-protocol/protocol/getHis` endpoint via firewall/WAF rules.