Description

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-06T09:17:16.310Z",
  "pubdate": "2026-09-06T09:17:16.310Z",
  "executiveSummary": "The diem-project diem framework up to version 5.1.3 contains a critical Cross-Site Request Forgery (CSRF) vulnerability within its dmConsole component.\nThe vulnerability originates in the executeCommand function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file.\nBy manipulating the dm_command argument, an unauthenticated or remote attacker can force an administrative user to execute unauthorized console commands on the host server.\nThis flaw allows for remote command execution under the security context of the authenticated administrator, potentially leading to full system compromise.\nThe risk is high as the exploit is publicly disclosed, and the project has not provided a vendor-supplied patch.\nExploitation requires that an authenticated administrator visits a malicious web page or clicks a crafted link while logged into the Diem administration interface.",
  "technicalDetails": "The vulnerability resides within the dmConsole component of the dmAdminPlugin in the Diem framework, specifically targeting the executeCommand action.\nThe root cause is the absence of anti-CSRF tokens or state-changing request validation within the executeCommand function located in dmAdminPlugin/modules/dmConsole/actions/actions.class.php.\nIn a standard implementation, state-changing requests—particularly those capable of executing system or framework-level commands—must be protected by cryptographically secure, per-session, or per-request tokens to verify that the request was intentionally initiated by the legitimate user through the application's UI.\nBecause the dm_command parameter is processed without these security controls, the application fails to distinguish between a legitimate request originated from the administrative dashboard and a forged request initiated from a third-party, attacker-controlled domain.\nThe attack flow begins when an attacker crafts a malicious URI or an HTML form that targets the vulnerable /dmConsole/executeCommand endpoint with a specific payload assigned to the dm_command argument. The attacker then lures an authenticated administrator into triggering this request, typically through social engineering or by embedding the malicious link on an external site.\nOnce the administrator's browser sends the request to the Diem application, the browser automatically attaches the administrator's session cookies. Since the application does not validate the integrity or the origin of the request, it accepts the dm_command and executes the specified console command with the server-side privileges of the administrator.\nThe post-exploitation impact is severe, as the console functionality often facilitates deep interaction with the framework, including database operations, file manipulation, or further arbitrary code execution. This allows an attacker to pivot from a simple CSRF vulnerability to full remote command execution (RCE) on the underlying operating system.\nAffected versions include all Diem releases up to 5.1.3. As the vulnerability is remote and requires no specific authentication bypass—only the active session of an existing administrator—the attack surface is broad for any internet-facing administrative panel.\nFurthermore, because the project has not responded to vulnerability reports, there is currently no official patch, leaving installations exposed to publicly disclosed exploits."
}