Executive brief
Spug is a lightweight automation and operations platform used by enterprises for host management, deployment, and monitoring. A vulnerability in the monitoring feature allows authenticated users with monitor permissions to execute arbitrary commands on the server by injecting shell metacharacters into network test parameters, potentially compromising the entire system.
Technical details
The vulnerability is a command injection flaw in the ping_check function within Spug's monitoring module (apps/monitor/executors.py). User-supplied monitor address parameters are interpolated directly into shell commands via the /monitor/run_test/ endpoint without proper sanitization or escaping. An authenticated attacker with monitor permissions can inject shell metacharacters (e.g., |, ;, &, $()) to break out of the intended command and execute arbitrary code as the Spug process user. The attack requires authentication and monitor-level permissions, but no additional user interaction. A patch should implement input validation, parameterized command execution, or shell escaping.
Affected products
- OpenSpug Spug through 3.4.0
Timeline
- 2026-09-13: disclosed