{"id":18366,"date":"2025-04-06T05:07:59","date_gmt":"2025-04-06T05:07:59","guid":{"rendered":""},"modified":"2025-09-16T12:32:08","modified_gmt":"2025-09-16T18:32:08","slug":"cve-2023-50094-authenticated-command-injection-vulnerability-in-rengine","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-50094-authenticated-command-injection-vulnerability-in-rengine\/","title":{"rendered":"CVE-2023-50094: Authenticated Command Injection Vulnerability in reNgine"},"content":{"rendered":"

Overview<\/h2>\n

CVE-2023-50094 is a critical authenticated command injection vulnerability discovered in reNgine, an automated reconnaissance framework widely used by penetration testers and bug bounty hunters. This flaw allows authenticated users to execute arbitrary shell commands on the reNgine host, leading to full system compromise in vulnerable configurations.<\/p>\n

Due to the nature of reNgine as a network-facing recon tool with command-line integration, exploitation of this vulnerability could provide attackers with persistent shell access, privilege escalation pathways, and data exfiltration opportunities.<\/p>\n

Vulnerability Summary<\/h2>\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n
Field<\/th>\nDetail<\/th>\n<\/tr>\n<\/thead>\n
CVE ID<\/strong><\/td>\nCVE-2023-50094<\/td>\n<\/tr>\n
Severity<\/strong><\/td>\nCritical (CVSS Score: 8.8)<\/td>\n<\/tr>\n
Attack Vector<\/strong><\/td>\nNetwork<\/td>\n<\/tr>\n
Privileges Required<\/strong><\/td>\nLow (Authenticated User<\/a>)<\/td>\n<\/tr>\n
User Interaction<\/strong><\/td>\nNone<\/td>\n<\/tr>\n
Impact<\/strong><\/td>\nRemote Code Execution<\/a> (RCE)<\/td>\n<\/tr>\n
Affected Endpoint<\/strong><\/td>\n\/api\/tools\/waf_detector\/<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Affected Products<\/h2>\n
\n
\n\n\n\n\n\n
Product<\/th>\nAffected Versions<\/th>\n<\/tr>\n<\/thead>\n
reNgine<\/td>\nv1.2.0 to v2.0.2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

How the Exploit Works<\/h2>\n

The vulnerability is located in the WAF detection API<\/a> route (\/api\/tools\/waf_detector\/<\/code>) where the url<\/code> parameter is directly interpolated into a shell command using Python\u2019s subprocess.check_output<\/code> with shell=True<\/code>.<\/p>\n

Because the input is not sanitized, attackers can inject arbitrary commands<\/a> using shell metacharacters like ;<\/code>, &&<\/code>, or |<\/code>. If the application is running with elevated privileges (e.g., as root inside Docker), this can lead to full system<\/a> control.<\/p>\n

Conceptual Exploit Example<\/h2>\n

Here is a conceptual example demonstrating how an attacker could exploit<\/a> the flaw:<\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n