OS Command Injection in django-pyas2

Executive Summary

django-pyas2 through version 1.2.3 has a vulnerability where the cmd_receive and cmd_send fields on the Partner model are passed directly to os.system() without sanitization. This allows an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.

Useful 0 Not Useful 0

Detection Guidance

Check for django-pyas2 installations with version 1.2.3 or earlier. Inspect the Partner model for cmd_receive and cmd_send fields in the admin interface. Monitor server logs for unexpected command execution during AS2 message processing.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could exploit this to run unauthorized commands on the server hosting django-pyas2. This could lead to data breaches, system compromise, or further network infiltration depending on the server's permissions and environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Compliance failures may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade django-pyas2 to the latest version immediately. Remove or restrict admin access to the Partner model fields cmd_receive and cmd_send. Implement input validation for these fields. Monitor network traffic for suspicious AS2 message activity.

Useful 0 Not Useful 0