AjaXplorer Remote Command Execution Vulnerability in checkInstall.php

A remote command execution vulnerability has been identified in AjaXplorer (now Pydio Cells) versions prior to 2.6. The issue arises in the checkInstall.php script within the access.ssh plugin, where user-supplied input to the destServer GET parameter is not properly sanitized. This lack of sanitation allows remote attackers to inject shell metacharacters and execute arbitrary system commands on the server, using the privileges of the web server process.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, with the same privileges as the web server user.

Reproduction

To reproduce this vulnerability, send a GET request to the 'plugins/access.ssh/checkInstall.php' endpoint with the 'destServer' parameter. Inject shell metacharacters to execute commands on the server. If the injected command's output is returned in the response, the server is vulnerable.

Remediation

Upgrade to AjaXplorer version 2.6 or later.