module
Web-Check Screenshot API Command Injection RCE
| Disclosed |
|---|
| Apr 12, 2025 |
Disclosed
Apr 12, 2025
Description
This module exploits a command injection vulnerability in Web-Check's `/api/screenshot` endpoint.
The `directChromiumScreenshot()` function uses `child_process.exec()` with unsanitized user input,
allowing command injection via URL query parameters. The vulnerability was patched in commit
0e4958aa10b2650d32439a799f6fc83a7cd46cef by replacing `exec()` with `execFile()`.
The `directChromiumScreenshot()` function uses `child_process.exec()` with unsanitized user input,
allowing command injection via URL query parameters. The vulnerability was patched in commit
0e4958aa10b2650d32439a799f6fc83a7cd46cef by replacing `exec()` with `execFile()`.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.