Executive brief
HaxCMS is a content management system used to build and manage websites. The gitImportSite feature allows authenticated users to import site content from a remote Git repository by providing a URL. An authenticated attacker can inject arbitrary operating system commands into this URL parameter, bypassing weak validation, to execute commands on the server and potentially steal sensitive data or compromise the system.
Technical details
The vulnerability is an OS command injection (CWE-78) in the gitImportSite function within Operations.php. The function accepts a user-supplied URL from a POST request and validates it only using filter_var() and strpos() functions, which fail to block Bash special characters (e.g., semicolons, command substitution syntax). The unsanitized URL is subsequently passed to proc_open(), allowing an attacker to inject arbitrary shell commands. The attack requires prior authentication to obtain a valid token, but no further user interaction is needed. An authenticated attacker can craft a malicious URL (e.g., using semicolons or $(command) syntax) to execute arbitrary OS commands and exfiltrate output via HTTP responses. The vulnerability was patched in version 11.0.3 for haxcms-nodejs and 11.0.0 for haxcms-php.
Affected products
- HAX HaxCMS-PHP <=10.0.6
- HAX HaxCMS-NodeJS <=10.0.6
Timeline
- 2025-06-09: disclosed: Advisory GHSA-g4cf-pp4x-hqgw published
- 2025-06-09: patched: HaxCMS-PHP 11.0.0 and HaxCMS-NodeJS 11.0.3 released