An authenticated remote code execution vulnerability in DbGate allows attackers with valid credentials to gain full root-level control over the host operating system.

The /runners/load-reader endpoint fails to sanitize the functionName parameter, allowing an authenticated user to bypass intended restrictions via dynamic import() calls and execute arbitrary OS commands with root privileges.

While this vulnerability requires authenticated access, the ability to escalate to root-level OS command execution poses a catastrophic risk. An attacker could exfiltrate sensitive database credentials, destroy data, or install persistent backdoors. The CVSS score of 9.4 emphasizes the extreme impact of this flaw.

Immediate Action: Update dbgate-api to version 7.1.9 or later immediately.

Proactive Monitoring: Audit user activity logs for suspicious interactions with the /runners/load-reader endpoint and monitor for unusual root-level process execution.

Compensating Controls: Enforce strict credential management and multi-factor authentication to limit the risk of account compromise that could be leveraged to trigger this exploit.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Although this vulnerability requires authentication, the potential for root-level command execution makes it a critical priority. Organizations should apply the 7.1.9 update immediately and review existing user accounts for signs of unauthorized access.