Remote Code Injection in chenhg5 cc-connect

A code injection vulnerability has been identified in chenhg5 cc-connect, affecting all versions up to and including 1.4.1. The vulnerability resides within the 'Authenticate' function located in 'core/webhook.go'. The application fails to properly neutralize user-controlled input passed to the 'exec' argument, allowing an unauthenticated remote attacker to inject and execute arbitrary code. The exploit for this vulnerability is currently public, increasing the risk of exploitation by threat actors targeting this service. Defenders should prioritize patching or restricting access to the affected webhook endpoint to prevent exploitation.

Impact

Successful exploitation allows for unauthenticated remote code execution on the server hosting the cc-connect service. This grants an attacker the ability to execute arbitrary commands, potentially leading to full system compromise, data exfiltration, or deployment of additional malicious payloads.

Recommendation

• Upgrade chenhg5 cc-connect to a patched version beyond 1.4.1 immediately.
• If patching is not feasible, implement strict input validation or block access to the 'core/webhook.go' endpoint at the web application firewall (WAF) or ingress proxy level, specifically monitoring for the 'exec' argument containing shell metacharacters.
• Review web server access logs for anomalous requests to webhook endpoints involving the 'exec' parameter.