CVE-2025-50201: Wegia OS Command Injection RCE Flaw

CVE-2025-50201 Overview

CVE-2025-50201 is a critical OS Command Injection vulnerability discovered in WeGIA, a web manager application designed for charitable institutions. The vulnerability exists in the /html/configuracao/debug_info.php endpoint where the branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data).

Critical Impact
Unauthenticated attackers can achieve full remote code execution on vulnerable WeGIA installations, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

WeGIA versions prior to 3.4.2
WeGIA web manager installations with exposed /html/configuracao/debug_info.php endpoint
Systems running WeGIA under www-data user context

Discovery Timeline

2025-06-19 - CVE-2025-50201 published to NVD
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2025-50201

Vulnerability Analysis

This vulnerability represents a classic OS Command Injection flaw (CWE-78) where user-supplied input is directly incorporated into a shell command without proper sanitization. The vulnerable code path exists in the gitCheckout() function within the debug_info.php file. When a user supplies a malicious branch parameter, the application concatenates this value directly into a git checkout command executed via PHP's exec() function.

Because the endpoint does not require authentication, any remote attacker with network access to the WeGIA installation can exploit this vulnerability. Successful exploitation grants the attacker the ability to execute arbitrary system commands with the privileges of the web server process, typically running as www-data on Linux systems.

Root Cause

The root cause is the direct use of unsanitized user input in a shell command. The vulnerable gitCheckout() function constructs a command string by concatenating the user-supplied $branch variable directly into the exec() call without applying any input validation or escaping mechanisms. This allows attackers to inject additional shell commands using standard shell metacharacters such as semicolons, pipes, or command substitution syntax.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft a malicious HTTP request to the /html/configuracao/debug_info.php endpoint with a specially crafted branch parameter containing shell metacharacters and malicious commands. The vulnerable code path will execute these injected commands in the context of the web server process.

php

// Vulnerable code (before patch)
function gitCheckout($branch) {
    $output = array();
    exec("git -C ".ROOT." checkout $branch", $output);
    return $output;
}

// Patched code (version 3.4.2+)
function gitCheckout($branch) {
    $output = array();
    exec("git -C " . ROOT . " checkout " . escapeshellarg($branch), $output);
    return $output;
}

Source: GitHub Commit Update

Detection Methods for CVE-2025-50201

Indicators of Compromise

Unusual HTTP requests to /html/configuracao/debug_info.php with suspicious branch parameter values containing shell metacharacters (;, |, $(), backticks)
Web server logs showing requests with encoded command injection payloads in URL parameters
Unexpected processes spawned as child processes of the web server (Apache, Nginx, or PHP-FPM)
Anomalous outbound network connections from the www-data user account
Unauthorized file modifications or new files created in web-accessible directories

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block requests containing shell metacharacters in the branch parameter
Monitor web server access logs for requests to /html/configuracao/debug_info.php from external IP addresses
Deploy endpoint detection and response (EDR) solutions to identify command injection attack patterns
Configure intrusion detection systems (IDS) with signatures for OS command injection attempts targeting PHP applications

Monitoring Recommendations

Enable verbose logging for the WeGIA application and web server to capture full request parameters
Establish baseline behavior for process creation by the web server and alert on deviations
Monitor for unexpected network connections originating from web application processes
Implement file integrity monitoring on critical WeGIA installation directories

How to Mitigate CVE-2025-50201

Immediate Actions Required

Upgrade WeGIA to version 3.4.2 or later immediately
If immediate patching is not possible, restrict network access to the /html/configuracao/ directory using web server configuration
Audit web server logs for evidence of exploitation attempts
Review system for signs of compromise if the vulnerable endpoint was exposed

Patch Information

WeGIA has released version 3.4.2 which addresses this vulnerability by implementing proper input sanitization using PHP's escapeshellarg() function. The fix ensures that the branch parameter is properly escaped before being passed to the shell command, preventing injection of arbitrary commands.

Review the official security advisory for complete details: GitHub Security Advisory GHSA-52p5-5fmw-9hrf

The specific commit implementing the fix can be reviewed at: GitHub Commit Update

Workarounds

Block access to /html/configuracao/debug_info.php at the web server level using access control directives
Implement network-level restrictions to limit access to the WeGIA administrative interface to trusted IP addresses only
Deploy a WAF rule to filter requests containing shell metacharacters in the branch parameter
Disable or remove the debug functionality if not required for operations

bash

# Apache configuration to restrict access to vulnerable endpoint
<Location /html/configuracao/debug_info.php>
    Require ip 127.0.0.1
    Require ip 10.0.0.0/8
</Location>

# Nginx configuration alternative
location /html/configuracao/debug_info.php {
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
}