Description

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, resulting in an authenticated Remote Code Execution (RCE). A low-privileged user with permission to create or edit devices can execute arbitrary operating system commands on the UpSnap hosted server. Version 5.4.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-12T23:17:21.363Z",
  "pubdate": "2026-08-12T23:17:21.363Z",
  "executiveSummary": "An authenticated OS command injection vulnerability exists within the device management functionality of UpSnap versions prior to 5.4.0. The vulnerability allows a low-privileged authenticated user with permissions to create or edit devices to inject malicious command sequences into the wake_cmd and shutdown_cmd fields. These unsanitized inputs are subsequently processed and evaluated via unsafe shell command template interpolation, executing directly through the underlying operating system command interpreter such as /bin/sh -c on Linux or cmd /C on Windows.\nThe primary impact of this security flaw is Remote Code Execution (RCE) on the host server running the UpSnap application. Successful exploitation enables an attacker to execute arbitrary operating system commands under the security context and privileges of the hosting server process. This compromises the confidentiality, integrity, and availability of the host system. Prerequisites for exploitation include valid low-privileged authentication to the web application and the authorization to perform device management operations, specifically the capability to modify or create device configurations containing the vulnerable wake and shutdown command parameters.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of user-controlled input within the device management functionality of UpSnap. Specifically, the application implements unsafe shell command template interpolation utilizing the ip and the mac fields. User-supplied values destined for the wake_cmd and shutdown_cmd templates fail to undergo rigorous sanitization, input validation, or parameterization before being passed to the underlying execution layer.\nWhen a user creates or edits a device configuration, malicious command payloads embedded within the vulnerable parameters are accepted by the application backend. During execution, these templates are evaluated and passed directly to the system shell—invoking /bin/sh -c on Linux systems or cmd /C on Windows environments. The shell interprets the concatenated string, executing any injected command syntax alongside or in place of the intended wake-on-LAN operations.\nThe affected components are the device management routines handling wake_cmd and shutdown_cmd template processing within UpSnap versions prior to 5.4.0. Exploitation requires the attacker to possess network access to the UpSnap web application, an active authenticated session, and low-privileged user rights sufficient to create or edit device entries. Upon successful delivery of the crafted payload via the device configuration interface, the payload behavior manifests as direct operating system command execution, facilitating comprehensive post-exploitation capabilities and full system compromise on the target host."
}