databasement: Authenticated RCE via the Backup "Database Names" Field

Summary

databasement runs the dump client (mariadb-dump) as a shell command, and a logged-in user controls the database name that goes into it. The database name is validated only as a generic string, so a value such as--result-file=/app/public/index.php is passed to mariadb-dump and interpreted as an option, allowing an arbitrary file write.

Details

• app/Http/Requests/Api/V1/SaveDatabaseServerRequest.php (lines 118-119): for MySQL/PostgreSQL/MongoDB, backups.*.database_names.* is validated only as string|max:255 (no SafeDumpFlags/identifier check, unlike dump_flags).
• app/Services/Backup/Databases/MysqlDatabase.php (lines 101-134): dump() builds a shell command string placing the database name as a bare positional argument.
• app/Services/Backup/ShellProcessor.php (line 39): executes it via Process::fromShellCommandline.
• The same positional-database pattern applies to PostgresqlDatabase.php and the restore clients.

PoC

Refer to the attached report for step by step along with POC screenshots. Authenticated RCE.pdf

Impact

• Remote code execution as the web-application user, reachable by any authenticated member.
• Disclosure of the application key, allowing decryption of all stored database credentials, SSH private keys, and cloud/storage secrets across every configured server and organization; pivot to those targets; tamper with backups/restores.
• Arbitrary file write to any path the application user can reach is the underlying primitive.