Description

A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py/web.py. The manipulation of the argument case_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T02:17:04.930Z",
  "pubdate": "2026-09-13T02:17:04.930Z",
  "executiveSummary": "The web_robot application (versions 2.4.0, 2.5.0, and 2.8.0) is susceptible to an OS command injection vulnerability. This flaw resides within the controller_listen and controller_recover functions located in py/web.py.\nThe vulnerability occurs due to the improper neutralization of user-supplied input provided to the case_name argument, allowing an unauthenticated remote attacker to execute arbitrary operating system commands on the underlying host.\nThis vulnerability poses a critical risk to the integrity, confidentiality, and availability of the affected system. Successful exploitation grants an attacker the ability to execute commands with the privileges of the web_robot process, potentially leading to a full system compromise.\nBecause the vulnerability is remotely exploitable and exploit code has been disclosed publicly, the risk of active exploitation is significant. The vendor has been notified but has remained unresponsive, meaning no official vendor-provided patches are available for these versions.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the py/web.py file of web_robot versions 2.4.0, 2.5.0, and 2.8.0. The flaw stems from the insecure handling of the case_name argument within the controller_listen and controller_recover functions.\nIn these functions, the application takes the user-provided case_name input and passes it into a system-level command execution routine without sufficient input sanitization or validation. This allows an attacker to inject shell metacharacters—such as semicolons, pipes, or backticks—into the case_name parameter, effectively breaking out of the intended command context and appending malicious shell commands.\nThe attack flow begins when an attacker sends a crafted request to the web_robot application. By manipulating the case_name parameter with an injected payload (e.g., '; rm -rf /;'), the attacker causes the underlying Python interpreter to execute the payload via the vulnerable system call. Because the input is processed directly in the controller_listen or controller_recover logic, no special authentication is required to trigger this execution flow.\nFrom a network perspective, the service is exposed to remote interaction, allowing an attacker to achieve Remote Code Execution (RCE) without prior access to the system. Once the injected payload is processed, the system executes the attacker-defined commands with the context of the user running the application. This typically enables the attacker to install persistent backdoors, escalate privileges, exfiltrate sensitive data from the host file system, or pivot further into the internal network environment.\nThe lack of input validation and the use of dangerous functions that interface directly with the system shell are the primary root causes. The vulnerability persists across multiple versions, indicating a systemic failure in input handling throughout the lifecycle of the web_robot library's controller components."
}