Summary
Dromara Skyeye contains a critical OS command injection vulnerability in the unauthenticated text-to-speech endpoint. An attacker may manipulate the format parameter to escape a PowerShell string and execute operating-system commands as the Skyeye service account when the endpoint is exposed.
Dromara Skyeye contains a critical OS command injection vulnerability in the unauthenticated text-to-speech endpoint. An attacker may manipulate the format parameter to escape a PowerShell string and execute operating-system commands as the Skyeye service account when the endpoint is exposed.
Affected context
The vulnerability occurs in Skyeye deployments that expose the /post/TtsController/textToSpeech endpoint and construct a PowerShell command using the format request parameter. Risk is greater when the service is reachable without authentication and runs with permissions that allow access to sensitive files, services, or other system resources on Windows.
The vulnerability occurs in Skyeye deployments that expose the /post/TtsController/textToSpeech endpoint and construct a PowerShell command using the format request parameter. Risk is greater when the service is reachable without authentication and runs with permissions that allow access to sensitive files, services, or other system resources on Windows.
Exploit preconditions
- Attack surface: HTTP request handling for the unauthenticated
/post/TtsController/textToSpeechendpoint - Required access: Network access to the endpoint; no application authentication may be required
- Trigger point: Processing of the
formatparameter during text-to-speech command construction - Why exploitation is possible: User-controlled input is incorporated into a PowerShell command without sufficiently preventing command-context interpretation
- Execution context: Commands may run with the privileges of the Skyeye service account on Windows
- Attack surface: HTTP request handling for the unauthenticated
/post/TtsController/textToSpeechendpoint - Required access: Network access to the endpoint; no application authentication may be required
- Trigger point: Processing of the
formatparameter during text-to-speech command construction - Why exploitation is possible: User-controlled input is incorporated into a PowerShell command without sufficiently preventing command-context interpretation
- Execution context: Commands may run with the privileges of the Skyeye service account on Windows
Why this happens
The issue is caused by passing externally controlled data into an operating-system command without robust argument separation and context-aware escaping. When request data is embedded directly in a PowerShell string, special characters can alter the intended command structure and cause additional commands to be interpreted. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The issue is caused by passing externally controlled data into an operating-system command without robust argument separation and context-aware escaping. When request data is embedded directly in a PowerShell string, special characters can alter the intended command structure and cause additional commands to be interpreted. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary commands on the Windows host
- The attacker could access, modify, or delete application and system data
- The Skyeye service account may be abused for persistence or lateral movement
- Compromise could affect other services, credentials, or connected infrastructure
- The vulnerability could enable data theft, service disruption, or malware deployment
- An attacker may execute arbitrary commands on the Windows host
- The attacker could access, modify, or delete application and system data
- The Skyeye service account may be abused for persistence or lateral movement
- Compromise could affect other services, credentials, or connected infrastructure
- The vulnerability could enable data theft, service disruption, or malware deployment
General mitigation guidance
Mitigation generally focuses on avoiding shell interpretation for application-controlled operations and reducing trust in request parameters.
Common defensive patterns include:
- Replacing shell-based execution with a native library or process API that passes arguments separately
- Applying strict allowlist validation for format values and rejecting unexpected characters or structures
- Avoiding dynamic command construction from HTTP parameters
- Running the service under a dedicated account with only the permissions required for text-to-speech processing
- Restricting unauthenticated access through authentication, authorization, network segmentation, or an application gateway
- Limiting outbound connectivity and sensitive filesystem access from the service process
- Logging rejected inputs and command-invocation failures without recording sensitive data
Mitigation generally focuses on avoiding shell interpretation for application-controlled operations and reducing trust in request parameters.
Common defensive patterns include:
- Replacing shell-based execution with a native library or process API that passes arguments separately
- Applying strict allowlist validation for format values and rejecting unexpected characters or structures
- Avoiding dynamic command construction from HTTP parameters
- Running the service under a dedicated account with only the permissions required for text-to-speech processing
- Restricting unauthenticated access through authentication, authorization, network segmentation, or an application gateway
- Limiting outbound connectivity and sensitive filesystem access from the service process
- Logging rejected inputs and command-invocation failures without recording sensitive data
How teams detect issues like this
High-level detection can include:
- Static analysis rules for concatenating request parameters into PowerShell, shell, or process-invocation calls
- Code review checks for command construction, dynamic quoting, and missing allowlist validation
- Policy enforcement that prohibits shell execution for user-controlled values
- Web application monitoring for unusual requests to the text-to-speech endpoint and anomalous parameter characters
- Host monitoring for unexpected child processes, scripting-engine activity, or commands spawned by the Skyeye service account
- Automated security review tools that identify command injection sinks and tainted data flows
High-level detection can include:
- Static analysis rules for concatenating request parameters into PowerShell, shell, or process-invocation calls
- Code review checks for command construction, dynamic quoting, and missing allowlist validation
- Policy enforcement that prohibits shell execution for user-controlled values
- Web application monitoring for unusual requests to the text-to-speech endpoint and anomalous parameter characters
- Host monitoring for unexpected child processes, scripting-engine activity, or commands spawned by the Skyeye service account
- Automated security review tools that identify command injection sinks and tainted data flows
