Sangfor OSM Unauthenticated RCE in /fort/portal_login #1 1. Basic Information 2. Summary A critical unauthenticated Remote Command Execution vulnerability exists in Sangfor OSM's login-related endpoint . The vulnerable logic is located in . The controller receives the raw HTTP request body as a string, passes it to , and then builds a shell command by concatenating the request body into an pipeline: The command is then executed through . Unlike the normal path, does not call . It sends the command directly to the local or remote shell executor, which ultimately runs it through . Because is a login-related endpoint and the deployed filters contain broad URI allow rules, the vulnerable command construction can be reached before normal authentication. The local function attempts blacklist-style shell escaping, but blacklist escaping is not a reliable security boundary for shell commands. 3. Screenshot Placeholders Screenshot 1: Product Login Page [SCREENSHOT-01: /fort/login page] Screenshot 2: /portal_login Mapping [SCREENSHOT-02: DpLoginController.dpLogin @RequestMapping(value="/portal_login")] Screenshot 3: Dangerous Command Construction [SCREENSHOT-03: decryption() builds echo pipe pipeline command] Screenshot 4: dpExec() Executes Command Without Generic Clean [SCREENSHOT-04: ShellExecutor.dpExec(cmds) execution path] Screenshot 5: Authentication Filter Allowlist Evidence [SCREENSHOT-05: HandleFilter / FortValidMenuFilter login URI allow logic] Screenshot 6: Safe Verification Output [SCREENSHOT-06: verify_rc001_safe.py output] 4. Asset Mapping For internal asset inventory, identify systems exposing the OSM login page: body marker: product marker: Do not include real target IP addresses, valid session identifiers, or exploit payloads in public advisories. 5. Authentication Analysis The vulnerable endpoint is part of the login flow and is reachable before a normal authenticated user session is established. 5.1 HandleFilter Login URI Allow Logic Decompiled code location: The filter contains broad allow logic for URI keys containing : Later session validation logic also explicitly excludes login-related paths: Since contains the substring , it matches the pre-auth allow condition. 5.2 FortValidMenuFilter Login URI Allow Logic Decompiled code location: The filter immediately allows requests whose URI contains : Therefore, the authorization/menu filter does not require a logged-in user for . 5.3 Conclusion Based on the login endpoint mapping and filter allowlist behavior, should be treated as an unauthenticated / pre-authentication RCE attack surface. 6. Vulnerability Details 6.1 Entry Point The vulnerable endpoint is handled by: Decompiled code location: Observed line references from the decompiled source: 6.2 Logic Flow 1. The endpoint receives a raw request body: 2. The request body is passed into . 3. builds a shell command: 4. The command is executed via : 6.3 Authentication Bypass The endpoint is reachable before normal authentication due to broad filter allowlist rules: allows URIs containing allows URIs containing 6.4 Shell Escaping Bypass The local function attempts blacklist-style shell escaping: However, blacklist escaping is not a reliable security boundary for shell commands. 6.5 Impact This vulnerability allows unauthenticated remote command execution on the affected system. An attacker can execute arbitrary commands with the privileges of the web server process. 6.6 Remediation Update to the latest version of Sangfor OSM that includes a fix for this vulnerability. Implement proper input validation and sanitization for all user-supplied data. Use parameterized commands or safe APIs for executing system commands. Restrict access to login-related endpoints to authenticated users only.