Syntx OS Command Injection Vulnerability Leading to Remote Code Execution

A critical OS command injection vulnerability has been identified in Syntx's command auto-approval module, affecting versions through 2.5.0. This vulnerability undermines the application's whitelist security mechanism by allowing attackers to inject malicious commands that are misidentified as safe. The issue arises because the command validation logic relies on fragile regular expressions that fail to properly handle standard Shell command substitution syntax, such as $(...) and backticks. As a result, injected commands can be executed by the underlying Shell, leading to remote code execution without any user interaction.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Syntx is running.