Description

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-27T17:18:52.633Z",
  "pubdate": "2026-08-27T17:18:52.633Z",
  "executiveSummary": "Liman server management software contains an OS command injection vulnerability prior to version 2.2.2 - 1103. The vulnerability originates from improper neutralization of user-supplied input within the log rotation configuration endpoint.\nBy manipulating the 'ip_address' parameter, an authenticated administrator can achieve arbitrary command execution on the underlying host operating system. This represents a critical security risk, as successful exploitation grants the attacker the same system-level privileges as the Liman process, potentially leading to full server compromise, data exfiltration, or persistence establishment.\nExploitation requires authenticated administrative access to the platform. There are no known non-authenticated or remote unauthenticated exploitation vectors, but the risk to internal infrastructure is significant given the elevated privilege requirement and the ability to execute OS-level commands.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the administrative log rotation configuration module of the Liman software. The root cause is the unsafe handling of the 'ip_address' parameter, which is concatenated directly into a backend shell command string without adequate input validation, sanitization, or parameterized execution.\nThe application architecture fails to treat the input as data, inadvertently allowing the input to influence the command structure. An attacker with administrative privileges can perform a shell escape by injecting crafted shell metacharacters, specifically single quotes ('), to terminate the intended command context and append arbitrary malicious commands. For instance, by providing an input string structured as 'some_ip'; [malicious_command] #, the attacker forces the system shell to execute the injected payload alongside or in place of the intended diagnostic or configuration routine.\nThe attack flow proceeds as follows: 1. The attacker authenticates to the Liman management interface with administrative credentials. 2. The attacker navigates to the log rotation configuration endpoint. 3. The attacker submits a specially crafted 'ip_address' payload containing shell-breaking sequences. 4. The server-side script receives the unvalidated input and passes it to an execution sink (e.g., system(), exec(), or popen()). 5. The host operating system parses the resulting command string and executes the injected commands with the effective UID of the Liman application service.\nBecause the input is processed on the server-side, the injected commands are executed with the permissions of the user running the Liman application. If the application is running as root or a user with sudo privileges, the attacker gains full control over the underlying Linux server. This facilitates post-exploitation activities such as installing backdoors, modifying configuration files, accessing sensitive logs, or pivoting into the internal network. The vulnerability remains present in all versions prior to 2.2.2 - 1103. Proper remediation requires the transition to parameterized interfaces that execute system utilities without invoking a shell, or strict allow-listing and regex-based input validation to ensure the 'ip_address' parameter adheres to standard IPv4/IPv6 address formats before any processing occurs."
}