Executive brief
mpush is a push messaging server that handles client connections and message broadcasts. A critical vulnerability in the gateway server allows attackers to execute arbitrary code on the server by sending a specially crafted broadcast message without authentication. This could allow an attacker to completely compromise the server, steal data, or use it as a foothold for lateral movement into the network.
Technical details
The vulnerability is a native script injection flaw in the mpush gateway server (port 3001, default bind 0.0.0.0). The gateway processes GATEWAY_PUSH broadcast messages with a "condition" field that is passed unfiltered to the Nashorn JavaScript engine via jsEngine.eval(). An attacker can craft a broadcast message containing malicious JavaScript that leverages Java.type() to access the Runtime class and execute arbitrary OS commands. The attack requires network reachability to port 3001 and at least one online user, but requires no authentication or encryption. JDK 8's Nashorn engine with Java interoperability is the enabling factor. mpush versions ≤ 0.8.1 are affected; patching requires filtering the condition field or disabling Java interop in the JavaScript engine.
Affected products
- mpush mpush ≤ 0.8.1
Timeline
- 2026-09-08: disclosed