OS Command Injection in Dromara Skyeye via TtsController

Executive Summary

This vulnerability is an OS command injection flaw in Dromara Skyeye. It exists in the unauthenticated /post/TtsController/textToSpeech endpoint due to improper input handling in the format parameter. Attackers can inject a single quote to break out of a PowerShell string and execute arbitrary commands as the Skyeye service account on Windows systems.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the affected endpoint /post/TtsController/textToSpeech is accessible on your network. Use network scanning tools like curl or wget to send a test request to the endpoint with a modified format parameter. For example, try accessing http://<target>/post/TtsController/textToSpeech?format='test' and observe if the response indicates command injection or unusual behavior.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious commands on your system with the privileges of the Skyeye service account. This may lead to data theft, system compromise, or further network infiltration. The high CVSS score indicates significant risk of unauthorized access and control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face fines or penalties if exploited due to inadequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /post/TtsController/textToSpeech endpoint by blocking external requests or disabling the service if not needed. Apply patches or updates from Dromara Skyeye if available. Monitor the service account running Skyeye for unusual activity and consider disabling PowerShell execution policies temporarily.

Useful 0 Not Useful 0