Executive brief
Sangfor's Operation and Maintenance Security Management System is a management platform used by IT teams to oversee infrastructure and security operations. A critical vulnerability in the login endpoint allows remote attackers to execute arbitrary commands on the system without any authentication, potentially giving attackers complete control over the infrastructure managed by this tool.
Technical details
This is an unauthenticated OS command injection vulnerability in the DpLoginController class of Sangfor OSM. The vulnerable /fort/portal_login endpoint processes user input and concatenates it unsafely into a shell command that is executed via ShellExecutor.dpExe(). The vulnerable code constructs a pipeline like "echo -n '<user_input>' | bash /usr/local/bin/aes256.sh decrypt -p '<password>'", then executes it through /bin/bash -c. Although a local clean() function attempts blacklist-based escaping, this is insufficient to prevent shell command injection. The endpoint is reachable pre-authentication because request filters contain broad allow rules for URIs containing the substring "login". No authentication is required to exploit this vulnerability, making it easily accessible over the network.
Affected products
- Sangfor Operation and Maintenance Security Management System up to 3.0.13
Timeline
- 2026-08-03: disclosed
- other: Vulnerability has been publicly disclosed on GitHub; vendor was contacted early but did not respond