GHSA-4gm2-62xx-xwvx: 
Python vulnerability analysis and mitigation

Summary

The port_scan tool (tools/portscan_tool.py) passed the caller-supplied target string to python-nmap's PortScanner.scan(hosts=...) without validation. A target containing whitespace-separated nmap options reached the nmap command line as separate arguments (CWE-88, argument injection).

Impact

An attacker able to control the target value could inject nmap command-line options. This was reproduced: appending -oN <path> to target made nmap create an output file at that path. Other nmap options can be injected the same way. Injected options run with the privileges of the user running the server. AynOps runs locally over stdio, so it is not directly network-exposed. Exploitation requires control over the target value passed to the tool.

Patches

Fixed in 1.2.0. target is now stripped of surrounding whitespace and must be an IP address, a CIDR network, or a hostname made of ASCII letters, digits, hyphens and dots. Inputs containing whitespace, starting with -, or using wildcards or octet ranges (for example 192.168.1.* or 10.0.0.1-20) are rejected with an Invalid target error before nmap is invoked.

Workarounds

Upgrade to 1.2.0. If you cannot upgrade, do not let untrusted input reach the port_scan tool.

Resources

• Release: https://github.com/AynOps/AynOps/releases/tag/v1.2.0

Credits

Thanks to @KulFilip for reporting the issue and contributing the fix.