Attack Chain

1. Attacker authenticates to the ShowDoc application.
2. Attacker crafts a malicious mockjs template containing shell commands.
3. Attacker submits the payload via the MockController::add endpoint.
4. The malicious template is stored in the application database.
5. Attacker triggers execution by accessing the MockController::infoByKey endpoint.
6. The application processes the template using eval(), executing the payload as root.

Impact

Successful exploitation allows for arbitrary command execution with root privileges when the application is running in the official Docker environment.

Recommendation

Upgrade ShowDoc to version 3.9.6 or later to address the vulnerable Mock feature.