Oinone Pamirs Code Execution Vulnerability in ScriptRunner Component

A remote code execution vulnerability has been identified in Oinone Pamirs version 7.0.0. The issue arises in the ScriptRunner component, specifically within the ScriptRunner.run method, which evaluates script expressions controlled by attackers. This evaluation is done through the underlying script engine, such as Groovy, without any sandboxing or allowlist restrictions. As a result, untrusted input can be executed as arbitrary code in the application process, potentially leading to unauthorized file access, configuration disclosure, network access, or execution of operating system commands with the privileges of the running service.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the server-side application context.

Remediation

Users can upgrade to Oinone Pamirs version 7.2.3, where this vulnerability has been fixed.