CVE-2025-24962: Yogeshojha Rengine RCE Vulnerability

CVE-2025-24962 Overview

CVE-2025-24962 is a command injection vulnerability in reNgine, an open-source automated reconnaissance framework for web applications. Authenticated users can inject arbitrary operating system commands through the nmap_cmd parameter. The flaw exists in how reNgine constructs and executes nmap scan commands without validating user-supplied input. Successful exploitation grants the attacker code execution within the reNgine application context, exposing scan data, credentials, and downstream targets. The maintainer addressed the issue in commit c28e5c8d by introducing an is_valid_nmap_command validation routine. This CVE affects reNgine version 2.2.0 and is tracked under [CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component].

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the reNgine host, compromising reconnaissance data and pivoting to scanned targets.

Affected Products

yogeshojha reNgine 2.2.0
reNgine versions prior to the fix in commit c28e5c8d
Self-hosted reNgine deployments using vulnerable nmap_cmd handling

Discovery Timeline

2025-02-03 - CVE-2025-24962 published to NVD
2025-05-13 - Last updated in NVD database

Technical Details for CVE-2025-24962

Vulnerability Analysis

reNgine orchestrates third-party scanners, including nmap, by assembling shell command strings from user-controlled scan options. The nmap_cmd parameter feeds directly into command construction inside web/reNgine/common_func.py and web/reNgine/tasks.py. Because the application did not validate the resulting command, an authenticated user could append shell metacharacters or additional binaries to the nmap invocation. The injected payload executes with the privileges of the reNgine worker process, typically inside the application container. Attackers gain access to API tokens, target lists, scan artifacts, and any credentials stored for downstream tools. The reconnaissance role of reNgine means a compromised instance can be weaponized against the same external targets it monitors.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream component [CWE-74]. The _build_cmd helper concatenated user input into the nmap command without enforcing an allowlist of flags or argument shapes. No validation function existed to confirm that the resulting string represented a legitimate nmap invocation before handing it to run_command.

Attack Vector

Exploitation requires network access to the reNgine web interface and a valid authenticated session. The attacker submits crafted nmap options through the scan configuration workflow, embedding shell separators such as ;, &&, or backticks. When reNgine launches the scan, the shell interprets the injected payload alongside the intended nmap command.

python

# Security patch in web/reNgine/common_func.py
# Source: https://github.com/yogeshojha/rengine/commit/c28e5c8d304478a787811580b4d80b330920ace4
	cmd = _build_cmd(cmd, options, flags)

	is_nmap_valid = is_valid_nmap_command(cmd)
	if not is_nmap_valid:
		logger.error(f'Invalid nmap command or potentially dangerous: {cmd}')
		return None

	if not input_file:
		cmd += f" {host}" if host else ""

The fix introduces is_valid_nmap_command(cmd) to inspect the constructed command and abort execution when the input does not match an expected nmap pattern. A companion change in web/reNgine/tasks.py handles the None return cleanly:

python

# Security patch in web/reNgine/tasks.py
# Source: https://github.com/yogeshojha/rengine/commit/c28e5c8d304478a787811580b4d80b330920ace4
		host=host,
		input_file=input_file,
		output_file=output_file_xml)
	
	if not nmap_cmd:
		logger.error('Could not build nmap command')
		return

	# Run cmd
	run_command(

Detection Methods for CVE-2025-24962

Indicators of Compromise

Unexpected child processes spawned by the reNgine worker or Celery container, especially shells such as /bin/sh, bash, curl, wget, or python invoked alongside nmap.
Outbound network connections from the reNgine host to attacker-controlled infrastructure shortly after a scan is triggered.
Log entries showing nmap commands containing shell metacharacters (;, |, &&, backticks, $(...)) in the nmap_cmd field.

Detection Strategies

Inspect reNgine application and Celery task logs for malformed nmap command strings or arguments that do not match documented nmap flags.
Monitor process lineage on the reNgine host; legitimate nmap scans should not spawn interactive shells or scripting interpreters as children.
Audit web request logs for POST bodies targeting scan configuration endpoints that contain shell metacharacters in nmap option fields.

Monitoring Recommendations

Forward container and host telemetry from reNgine deployments into a centralized log platform and alert on anomalous child processes of the scan worker.
Baseline normal outbound destinations for the reNgine host and alert on deviations, since scan workers typically only contact target assets.
Track invocations of run_command and review error events emitted by the new is_valid_nmap_command validator after patching.

How to Mitigate CVE-2025-24962

Immediate Actions Required

Update reNgine to a build that includes commit c28e5c8d304478a787811580b4d80b330920ace4 or apply the patch manually to web/reNgine/common_func.py and web/reNgine/tasks.py.
Restrict reNgine access to trusted operators only and rotate any API tokens, scanner credentials, or service accounts reachable from the host.
Audit recent scan jobs for unexpected nmap_cmd content and review host process history for signs of prior exploitation.

Patch Information

The maintainer fixed the issue in commit c28e5c8d, which adds the is_valid_nmap_command validation routine and aborts execution when the constructed nmap command fails validation. The fix is expected in the next versioned release. Additional context is available in the GitHub Security Advisory GHSA-cg75-ph7x-5rr9.

Workarounds

Filter and sanitize user input destined for nmap scan options at the reverse proxy or application layer until the patch is applied.
Place reNgine behind authenticated network controls such as a VPN or IP allowlist to limit exposure to attackers with valid accounts.
Run the reNgine worker container as an unprivileged user with a read-only filesystem and minimal outbound network egress to limit the impact of any successful injection.

bash

# Configuration example: apply the upstream patch to a deployed reNgine instance
cd /opt/rengine
git fetch origin
git cherry-pick c28e5c8d304478a787811580b4d80b330920ace4
docker compose build web celery
docker compose up -d web celery