Executive brief
ClearOS is a network gateway and edge server operating system used to manage firewall rules, VPN, and routing for small to mid-sized organizations. An authenticated attacker can inject arbitrary shell commands through the Log Viewer component, leading to immediate code execution and privilege escalation to root through default sudo rules, compromising the entire network gateway and creating a persistence foothold to pivot into internal networks.
Technical details
This is an OS command injection vulnerability in the Log Viewer endpoint of ClearOS 7.9. The root cause is in /usr/clearos/apps/base/libraries/File.php (lines 297, 314), where the filter parameter is interpolated directly into a shell command string without sanitization or proper escaping. An authenticated attacker can submit a filter parameter containing command substitution payloads (such as $(...) or backticks) that are executed as the webconfig user. The attack requires authentication to the Webconfig interface (port 81) but no user interaction. Upon successful exploitation, the attacker gains command execution as the webconfig user, which by default has extensive NOPASSWD sudo privileges allowing immediate escalation to root, yielding full OS-level compromise.
Affected products
- ClearFoundation ClearOS 7.9
Timeline
- 2026-08-03: disclosed