CVE-2026-2956
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on systems running vulnerable versions of qinming99 dst-admin. The command injection flaw in the revertBackup function enables attackers to gain control of affected servers. All users of dst-admin up to version 1.5.0 are affected.
💻 Affected Systems
- qinming99 dst-admin
📦 What is this software?
Dst Admin by Dst Admin Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, steal data, pivot to other systems, or establish persistent backdoors.
Likely Case
Unauthorized command execution leading to service disruption, data theft, or cryptocurrency mining malware installation.
If Mitigated
Limited impact through network segmentation and proper input validation, potentially preventing successful exploitation.
🎯 Exploit Status
Exploit code is publicly available and can be launched remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 1.5.0 if released by vendor, or implement workarounds.
🔧 Temporary Workarounds
Input Validation Filter
linuxImplement strict input validation to block command injection characters in the Name parameter
# Add input validation in /home/restore endpoint
# Filter: [;&|`$()\n\r\t] and other shell metacharacters
Network Access Restriction
linuxRestrict access to dst-admin service to trusted IP addresses only
iptables -A INPUT -p tcp --dport [DST-ADMIN-PORT] -s [TRUSTED-IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [DST-ADMIN-PORT] -j DROP
🧯 If You Can't Patch
- Disable or block access to the /home/restore endpoint completely
- Implement network segmentation to isolate dst-admin instances from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if dst-admin version is 1.5.0 or earlier by examining version files or package managerCheck Version:
grep -r 'version' /path/to/dst-admin/installation/ || cat /path/to/dst-admin/version.txtVerify Fix Applied:
Test the /home/restore endpoint with command injection payloads to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs from dst-admin process
- Shell metacharacters in dst-admin access logs for /home/restore
Network Indicators:
- Unusual outbound connections from dst-admin server
- Traffic to /home/restore endpoint with suspicious parameters
SIEM Query:
source="dst-admin.log" AND ("revertBackup" AND ("|" OR ";" OR "`" OR "$" OR "(" OR ")"))