An authenticated OS command injection flaw in sysPass version 3.2.11 and earlier allows attackers with administrative privileges to execute arbitrary commands on the underlying host.

This is an OS command injection vulnerability (CWE-78) triggered by improper sanitization of the backup path input field. The attack requires an authenticated user with administrative privileges to successfully trigger the command execution.

Successful exploitation grants an attacker full control over the host server, enabling data exfiltration, lateral movement, or complete system takeover. While the CVSS score of 7.2 reflects a high severity, the requirement for administrative privileges limits the attack surface to malicious or compromised internal accounts.

Immediate Action: Verify the availability of a security patch from the vendor and apply it immediately to all sysPass instances.

Proactive Monitoring: Review audit logs for suspicious activity involving backup configurations or unexpected system-level command execution.

Compensating Controls: Limit access to administrative functionality within the sysPass interface to a minimal set of trusted personnel and implement File Integrity Monitoring (FIM) on the server.

Public Exploit Available: Unknown

Although this vulnerability requires administrative authentication, the potential for total system compromise is significant. Administrators should prioritize upgrading the software and auditing current administrative access to ensure only authorized users can perform system-altering tasks.