Most recent entries from all

EUVD-2026-203312

2026-10-05T08:36:14.284179+00:00

EUVD-2026-203312

fkie_cve-2024-52010

2026-10-05T08:36:14.284211+00:00

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In HandleCreateProxySession the request to create an SSH session is handled. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into sshCommand. This is possible, because, unlike hostname and port, the username is not validated or sanitized.

GHSA-7hpf-g48v-hw3j — Zoraxy has an authenticated command injection in the Web SSH feature

2026-10-05T08:36:14.284243+00:00

Affected: Go: github.com/tobychui/zoraxy

### Summary A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host.

### Details Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In [`HandleCreateProxySession`](https://github.com/tobychui/zoraxy/blob/9cb315ea6739d1cc201b690322d25166b12dc5db/src/webssh.go#L19) the request to create an SSH session is handled. After checking for the presence of required parameters, ensuring that the target is not the loopback interface and that there is actually an SSH service running on the target, `CreateNewConnection` is called:

https://github.com/tobychui/zoraxy/blob/e79a70b7acfa45c2445aff9d60e4e7525c89fec8/src/mod/sshprox/sshprox.go#L165-L178

In line 178, the `gotty` binary is executed running `sshCommand` from the line above. It contains the user-controlled variable `connAddr`, which includes the hostname of the SSH server and - if provided - the username. An attacker can exploit the `username` variable to escape from the `bash` command and inject arbitrary commands into `sshCommand`. This is possible, because, unlike hostname and port, the username is not validated or sanitized.

This vulnerability was introduced in https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0. If Zoraxy is run without authentication of the management interface (started with`-noauth`), this vulnerability can be exploited without…

openSUSE-SU-2024:14513-1 — govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media

2026-10-05T08:36:14.284288+00:00

govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media