{"schema":"threatline.record/2","record":{"id":"GHSA-hm57-pvxc-4pcm","aliases":["GHSA-hm57-pvxc-4pcm"],"summary":"Authenticated RCE via the Backup \"Database Names\" Field","details":"### Summary\r\ndatabasement runs the dump client (mariadb-dump) as a shell command, and a logged-in user controls the\r\ndatabase name that goes into it. The database name is validated only as a generic string, so a value such as--result-file=/app/public/index.php is passed to mariadb-dump and interpreted as an option, allowing\r\nan arbitrary file write.\r\n\r\n### Details\r\n- `app/Http/Requests/Api/V1/SaveDatabaseServerRequest.php` (lines 118-119): for MySQL/PostgreSQL/MongoDB, `backups.*.database_names.*` is validated only as `string|max:255` (no `SafeDumpFlags`/identifier check, unlike `dump_flags`).\r\n- `app/Services/Backup/Databases/MysqlDatabase.php` (lines 101-134): `dump()` builds a shell command string placing the database name as a bare positional argument.\r\n- `app/Services/Backup/ShellProcessor.php` (line 39): executes it via `Process::fromShellCommandline`.\r\n- The same positional-database pattern applies to `PostgresqlDatabase.php` and the restore clients.\r\n\r\n### PoC\r\nRefer to the attached report for step by step along with POC screenshots.\r\n[Authenticated RCE.pdf](https://github.com/user-attachments/files/32690736/Authenticated.RCE.pdf)\r\n\r\n### Impact\r\n- Remote code execution as the web-application user, reachable by any authenticated `member`.\r\n- Disclosure of the application key, allowing decryption of all stored database credentials, SSH private keys, and cloud/storage secrets across every configured server and organization; pivot to those targets; tamper with backups/restores.\r\n- Arbitrary file write to any path the application user can reach is the underlying primitive.","categories":["Unclassified"],"product":"databasement","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","source_modified_at":"2026-09-28T18:55:56Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"databasement"},"range":">= 1.0.0, < 1.8.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","source_modified_at":"2026-09-28T18:55:56Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"databasement"},"version":"1.8.2"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T18:55:56Z","modified_at":"2026-09-28T18:55:56Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-09-28T18:55:56Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T18:55:56Z","content_hash":"305d08c434a4745961064e925c8b000e048d01a285d32737fea3ff24605a5e8a"}}