{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/pheditor--2.0.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pheditor (\u003c= 2.0.6)"],"_cs_severities":["high"],"_cs_tags":["argument-injection","rce","web-application","cwe-88"],"_cs_type":"advisory","_cs_vendors":["Pheditor"],"content_html":"\u003cp\u003ePheditor, a web-based code editor, contains a critical vulnerability (CWE-88) in its terminal feature that allows for arbitrary command execution. Affecting versions up to and including 2.0.6, the flaw stems from inadequate validation of arguments passed to allowlisted terminal commands. While the system attempts to restrict commands via a prefix-based allowlist and a denylist for shell metacharacters, it fails to sanitize arguments, permitting injection into binaries like \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003egit\u003c/code\u003e, \u003ccode\u003ephp\u003c/code\u003e, and \u003ccode\u003etar\u003c/code\u003e. Attackers can append malicious flags (e.g., \u003ccode\u003e-exec\u003c/code\u003e for \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003e-r\u003c/code\u003e for \u003ccode\u003ephp\u003c/code\u003e, \u003ccode\u003e--checkpoint-action\u003c/code\u003e for \u003ccode\u003etar\u003c/code\u003e) to these binaries, bypassing the allowlist to execute arbitrary code. This exploit leverages existing binaries and does not require shell metacharacters, surviving previous sanitization fixes. When combined with the hardcoded default \u003ccode\u003eadmin\u003c/code\u003e password (GHSA-p4h7-p9rj-2pq2), this vulnerability can lead to effective unauthenticated remote code execution with web server privileges, posing a significant risk to Pheditor deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker gains access to the Pheditor web interface by leveraging the hardcoded default \u003ccode\u003eadmin\u003c/code\u003e password, achieving authenticated access.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the Pheditor's \u003ccode\u003eterminal\u003c/code\u003e action handler, which is designed to execute commands via \u003ccode\u003eshell_exec\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious command string that begins with an allowlisted binary (e.g., \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003egit\u003c/code\u003e, \u003ccode\u003ephp\u003c/code\u003e, \u003ccode\u003etar\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe crafted command includes arguments specific to the chosen binary that enable arbitrary command execution (e.g., \u003ccode\u003efind ... -exec\u003c/code\u003e, \u003ccode\u003egit -c alias.x=\u003c/code\u003e, \u003ccode\u003ephp -r\u003c/code\u003e, \u003ccode\u003etar ... --checkpoint-action\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker sends a POST request containing this crafted \u003ccode\u003ecommand\u003c/code\u003e string to the \u003ccode\u003eterminal\u003c/code\u003e action.\u003c/li\u003e\n\u003cli\u003ePheditor's \u003ccode\u003epheditor.php\u003c/code\u003e code performs a prefix match against the \u003ccode\u003eTERMINAL_COMMANDS\u003c/code\u003e allowlist and checks for a denylist of shell metacharacters.\u003c/li\u003e\n\u003cli\u003eSince the command starts with an allowlisted binary and does not contain the forbidden metacharacters, the check passes.\u003c/li\u003e\n\u003cli\u003eThe application executes the full crafted command via \u003ccode\u003eshell_exec\u003c/code\u003e, leading to arbitrary command execution on the host with the web server's privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in arbitrary command execution on the host system, operating under the privileges of the web server process. This allows attackers to completely compromise the underlying server, leading to data exfiltration, modification, or deletion, installation of additional malware (e.g., backdoors, cryptocurrency miners), or complete system takeover. When combined with the hardcoded default \u003ccode\u003eadmin\u003c/code\u003e password, this flaw effectively becomes an unauthenticated remote code execution vector, dramatically increasing its severity and the attack surface for default Pheditor installations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Pheditor to a patched version that correctly validates terminal command arguments or remove the application from production if no patch is available.\u003c/li\u003e\n\u003cli\u003eImplement robust input validation for all user-supplied command arguments, ensuring that only expected values and structures are permitted.\u003c/li\u003e\n\u003cli\u003eIf Pheditor is deployed, change the default \u003ccode\u003eadmin\u003c/code\u003e password immediately to mitigate unauthorized access to the \u003ccode\u003eterminal\u003c/code\u003e feature, as documented in GHSA-p4h7-p9rj-2pq2.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment to detect attempts at argument injection via the \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003egit\u003c/code\u003e, \u003ccode\u003ephp\u003c/code\u003e, and \u003ccode\u003etar\u003c/code\u003e commands.\u003c/li\u003e\n\u003cli\u003eEnable \u003ccode\u003eprocess_creation\u003c/code\u003e logging for Linux systems to capture command-line arguments, which is essential for activating the rules above.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:49:04Z","date_published":"2026-07-24T21:49:04Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pheditor-terminal-rce/","summary":"A vulnerability in Pheditor's terminal feature (versions \u003c= 2.0.6) allows authenticated attackers to achieve arbitrary command execution via argument injection into allowlisted binaries, which can be chained with default credentials for effective unauthenticated remote code execution on the underlying host.","title":"Pheditor Terminal Argument Injection Leads to Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-07-pheditor-terminal-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Pheditor (\u003c= 2.0.6)","version":"https://jsonfeed.org/version/1.1"}