mdserver-web Unauthorized Remote Command Execution Vulnerability

A remote command execution vulnerability has been identified in mdserver-web versions 0.18.0 prior to 0.18.4. This issue arises from the lack of authentication on the '/modify_crond' and '/start_task' interfaces, allowing unauthorized users to modify default scheduled tasks and execute them, leading to remote code execution.

Impact

Exploitation of this vulnerability allows for unauthorized remote command execution on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the '/crontab/modify_crond' endpoint. Include the 'id' parameter to specify the task ID, and the 'sbody' parameter with the command to be executed, such as a reverse shell command. The absence of authentication on this endpoint allows the command to be executed without any authorization.