JVN#44033918: Zeroshell vulnerable to OS command injection

The web interface of Zeroshell, Linux distribution provided by Zeroshell.org, contains an OS command injection vulnerability (CWE-78).

Impact

Processing a crafted HTTP request may lead to an arbitrary OS command execution.

Solution

Stop using the product
The developer states that the affected product is no longer being developed and is End-of-support in 2021.
The developer recommends stop using the product.

Products Affected

• Zeroshell 3.9.3 and earlier
  The reporter verified this vulnerability on 3.9.3.
  It is unknown whether the issue is fixed or not on later versions.
  See also [JPCERT/CC Addendum] section below.