Executive Summary

CVE-2026-1413 is a critical remote command injection vulnerability in Sangfor's Operation and Maintenance Security Management System (OSM) up to version 3.0.12. It affects the portValidate function accessed via an HTTP POST request. The vulnerability arises because the 'port' parameter is not properly validated or sanitized, allowing attackers to inject arbitrary shell commands using command separators like ';' or '|'. These commands are executed on the server through a shell executor, enabling remote code execution without authentication. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the server hosting the Sangfor OSM system. This can lead to full compromise of the system's confidentiality, integrity, and availability. Attackers could run malicious commands, potentially gaining control over the server, accessing sensitive data, disrupting services, or deploying further attacks within the network. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by identifying systems running Sangfor Operation and Maintenance Security Management System (OSM) up to version 3.0.12 that expose the vulnerable HTTP POST endpoint `/fort/ip_and_port/port_validate`. A FOFA query to find affected systems is: `body="/fort/login" && product="SANGFOR-运维安全管理系统"`. To test for exploitation, you can send a crafted HTTP POST request to the endpoint with a malicious `port` parameter containing shell command separators such as `;` or `|`. For example, using curl: `curl -X POST -d "ip=8.8.8.8&port=80; id > /usr/local/tomcat/webapps/fort/trust/js/so_666.txt;" http://target/fort/ip_and_port/port_validate`. If the command executes and creates the file, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing strict input validation on the `port` parameter to allow only numeric values within the valid port range (1-65535), for example using a regex like `^\d{1,5}$`. Avoid using `Runtime.exec()` with concatenated command strings; instead, use safer methods such as `ProcessBuilder` with argument lists to prevent command injection. If possible, update or patch the affected Sangfor OSM system to a version that fixes this vulnerability or replace the product. Additionally, monitor and restrict access to the vulnerable endpoint and review logs for suspicious activity. [1]

Useful 0 Not Useful 0