Executive Summary

CVE-2025-15500 is a critical remote command execution vulnerability in Sangfor Operation and Maintenance Management System up to version 3.0.8. It occurs in the HTTP POST endpoint /isomp-protocol/protocol/getHis where the sessionPath parameter is improperly sanitized. An attacker can inject shell metacharacters into this parameter, which is then concatenated directly into a shell command and executed by the system. This allows the attacker to execute arbitrary operating system commands remotely without authentication, potentially with the privileges of the web server process (often root or tomcat). [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely impact confidentiality, integrity, and availability of the affected system. An attacker can remotely execute arbitrary commands on the server, potentially gaining control over the system, accessing sensitive data, modifying or deleting information, and disrupting services. Since no authentication is required, the attack is highly accessible and can lead to full system compromise. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint `/isomp-protocol/protocol/getHis` with a specially crafted `sessionPath` parameter that attempts to inject OS commands. For example, a proof-of-concept command is to send a POST request with payload `sessionPath=;whoami>/usr/local/tomcat/webapps/fort/trust/js/11yy.txt;&sid=1`. After sending this request, you can verify if the command executed by accessing the output file via a web browser at `/fort/trust/js/11yy.txt`. This confirms if arbitrary command execution is possible. Using tools like curl or any HTTP client, you can perform this test. Example curl command: `curl -X POST -d "sessionPath=;whoami>/usr/local/tomcat/webapps/fort/trust/js/11yy.txt;&sid=1" http://<target-ip>/isomp-protocol/protocol/getHis`. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict input validation on the `sessionPath` parameter by whitelisting allowed characters such as alphanumeric characters, `/`, `.`, and `_`, and rejecting any shell metacharacters. Additionally, avoid direct concatenation of user input into shell commands; instead, use secure coding practices such as Java's `ProcessBuilder` with argument lists to prevent shell interpretation. Since no patches or vendor countermeasures are available, consider replacing the affected product with an alternative solution to mitigate risk. [1, 2]

Useful 0 Not Useful 0