wise-security/cve-2025-69600Demonstrates command injection vulnerabilities in RayVentory Scan Engine's rvia tool, allowing arbitrary command execution via getconfig, upload, inventory, and oracle options.
Command injection in Raynet's rvia allows adversaries to execute commands via getconfig, upload, inventory, and oracle options.
A validation is only performed (if configured via the configuration property ForbiddenCurlChars in the /etc/rvia_configuration) when getting the URL from the /opt/rvia/rvia.cfg configuration file and not when the URL is directly passed to the options or .
getconfigupload/opt/rvia/rvia getconfig \;command\;
Under the hood, the constructed command looks as follows:
Through the option oracle it is also possible to inject commands.
This option might fail if a Java environment is not found by
rvia(under the hood a call to thefindcommand is made) and thejavaPathsoptions in the/opt/rvia/rvia.cfgis not set
In this case, the /opt/rvia/rvia.cfg is defined with the option javaPaths=/usr/lib/jvm/java-21-openjdk-amd64/.
/opt/rvia/rvia oracle \;command\;
The constructed command looks like this:
The same occurs at the configuration file (/opt/rvia/rvia.cfg) with the options oracleUser and oraclePass.
The call under the hood is the following one:
The same applies to the upload option by specifying a command to execute after the URL specification. In this case a previous scaped of double quotes is needed and also a hashtag at the end of the command to ignore the following arguments.
This option might fail if there are no inventory files at
/opt/rvia/results(by default) directory to upload which are created by the inventory option
/opt/rvia/rvia upload \"\;command\;#
From ltrace we see the following:
Finally, the inventory option is also vulnerable.
/opt/rvia/rvia inventory \;command\;
The constructed command under the hood:
