A critical remote code execution vulnerability in DbGate allows unauthenticated attackers to compromise the underlying host system via the JSON script runner.

The application fails to validate the functionName parameter within the POST /runners/start endpoint. This allows an unauthenticated attacker to inject code into dynamically generated JavaScript, which is then executed within a Node.js child process.

This vulnerability grants an attacker complete control over the host environment. The impact includes unauthorized access to connected databases, lateral movement within the network, and potential data exfiltration. The CVSS score of 10.0 reflects the absolute severity of this unauthenticated RCE condition.

Immediate Action: Update dbgate-serve to version 7.1.9 or later immediately.

Proactive Monitoring: Monitor for unauthorized POST requests to the /runners/start endpoint and investigate any unexpected child processes spawned by the dbgate service.

Compensating Controls: Restrict network access to the DbGate management interface using IP allowlisting or VPNs to ensure only authorized personnel can access the application.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

This vulnerability is of the highest severity and is currently subject to public proof-of-concept code. Immediate patching to version 7.1.9 is essential to prevent system takeover.