Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-12T14:17:12.563Z",
  "pubdate": "2026-10-12T14:17:12.563Z",
  "executiveSummary": "The UYAP Document Editor contains an OS command injection vulnerability, classified as an Improper Neutralization of Special Elements used in an OS Command (CWE-78). This security flaw exists due to inadequate sanitization of user-supplied input before it is processed by the underlying operating system shell.\nThe vulnerability affects all versions of the UYAP Document Editor prior to 5.4.20. An unauthenticated or remote attacker can exploit this weakness to execute arbitrary operating system commands with the privileges of the application process. Successful exploitation can lead to a complete compromise of the host system, facilitating unauthorized data access, modification, or the installation of malicious software.\nGiven the nature of document editing software, which often processes untrusted files or external inputs, this vulnerability poses a critical risk to organizational infrastructure. The ability to achieve arbitrary code execution via command injection provides an attacker with significant lateral movement and persistence capabilities within the affected environment.",
  "technicalDetails": "The core vulnerability stems from the application's failure to properly neutralize meta-characters and special elements when passing data to system-level APIs or shell execution functions. In the UYAP Document Editor, specific input fields or document-handling routines likely invoke system commands to perform file operations, format conversions, or document rendering. Because these inputs are not strictly validated or parameterized, an attacker can inject malicious shell operators—such as semicolons (;), pipes (|), or backticks (`)—to terminate the intended command and append arbitrary instructions.\nThe attack flow begins with the delivery of a malformed input—potentially embedded within a document or sent via a manipulated request—that the UYAP Document Editor processes. Upon parsing this input, the application constructs a shell command string incorporating the malicious payload. When the underlying execution function (e.g., system(), exec(), or popen()) processes this concatenated string, the shell interprets the injected sequences as legitimate instructions.\nBecause the application executes these commands within the context of the user running the editor, the payload inherits those user permissions. If the application is running with administrative or elevated privileges, the attacker can gain full system control. The exploitation does not inherently require complex memory corruption techniques; rather, it exploits the logic error in input handling, allowing the adversary to bypass intended application controls and interact directly with the operating system kernel and file system.\nThe vulnerability persists across all UYAP Document Editor versions prior to 5.4.20. Once the injected commands are executed, an attacker can perform various post-exploitation activities, including exfiltrating sensitive document content, deploying reverse shells for persistent access, or leveraging the compromised host as a pivot point for further network penetration. The lack of robust input filtering or the use of insecure shell invocation patterns are the primary drivers of this deficiency."
}