OpenBullet2 Remote Code Execution Vulnerability via FileProxySource Script Upload

A remote code execution vulnerability has been identified in OpenBullet2 versions through 0.3.2. This vulnerability allows authenticated users to execute arbitrary commands by uploading script files with extensions .bat, .ps1, or .sh through the FileProxySource proxy loading feature. Once uploaded as proxy sources, the server executes these scripts and returns the output as proxy lines, enabling command execution on the host as the process user.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host system.

Reproduction

To reproduce this vulnerability, upload a script file with a .bat, .ps1, or .sh extension through the FileProxySource proxy loading feature in OpenBullet2. The server will execute the uploaded script and return the output as proxy lines, indicating that the command has been executed on the host.

Remediation

Set a random API key in the OpenBullet2 settings to prevent unauthorized access.