-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an OS command injection in the ns_backup extension. I analyzed the provided commit patch (67b8102a19e8e516dc4228f5c42f9e4fba5046cb) which addresses this vulnerability.
There are two main vectors identified:
PHP Path Injection: The phpPath setting, configurable by an admin user, was used directly in an exec() call within NITSAN\NsBackup\Controller\BackupBaseController::generateBackup. If an attacker could set phpPath to a malicious string (e.g., '/usr/bin/php -r "system(\'id\');" #'), they could execute arbitrary commands. The functions NITSAN\NsBackup\Controller\BackupglobalController::createAction and NITSAN\NsBackup\Controller\BackupglobalController::updateAction were responsible for saving this setting without proper validation.
Argument Injection via Backup Name: The backupName parameter, taken from user input in NITSAN\NsBackup\Controller\BackupsController::backuprestoreAction, was used in NITSAN\NsBackup\Controller\BackupBaseController::getPhpbuBackup to construct a JSON configuration file for the phpbu.phar tool. This backupName was embedded into the JSON string without proper escaping, allowing an attacker to inject special characters to break the JSON structure and potentially inject malicious arguments into the phpbu.phar command line.
The patch addresses these by:
is_executable() checks for phpPath in BackupglobalController (create/update actions) and BackupBaseController::generateBackup.backupName input in BackupsController::backuprestoreAction to prevent injection into the JSON generated by getPhpbuBackup.The identified vulnerable functions are those directly involved in the exec() call, the unsafe construction of the JSON configuration, or the processing of the unsanitized user inputs that lead to these conditions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nitsan/ns-backup | composer | < 13.0.1 | 13.0.1 |
PHPPHPOngoing coverage of React2Shell