-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aliyundrive-webdav | rust | <= 2.3.3 | |
| aliyundrive-webdav | pip | <= 2.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs in the action_query_qrcode handler where the 'sid' parameter from the HTTP request is unsafely interpolated into a shell command. The code executes 'aliyundrive-webdav qr query --sid ' + user_input using luci.sys.exec, which passes the input through system shell interpretation. This allows attackers to inject arbitrary commands by including shell metacharacters in the sid parameter. The provided exploit example demonstrates successful command injection through the sid parameter, and the code structure clearly shows lack of input validation or escaping.
RustRustOngoing coverage of React2Shell