OS command injection in webgjc web_robot enables remote command execution

A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py/web.py. The manipulation of the argument case_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• webgjc web_robot 2.4.0: affected.
• webgjc web_robot 2.5.0: affected.
• webgjc web_robot 2.8.0: affected.

The record does not identify a fixed release or establish the status of other branches. A later or parallel release must not be assumed safe without separate confirmation.

webgjc web_robot processes the case_name argument in the controller_listen and controller_recover functions of py/web.py. The record states that manipulating this argument leads to OS command injection. The attack can be initiated remotely and the structured record characterizes it as requiring no prior privileges, but it does not identify a specific endpoint or deployment condition. The command construction, escaping failure, and privilege context of the executing process are not documented. The practical impact therefore depends on the permissions of the process running web_robot and the exposure of the relevant interface.

The record describes network reachability without a requirement for prior authentication or privileges. The structured assessment indicates passive user interaction, but it does not explain what user action is involved. The description states that the exploit has been publicly disclosed and may be used. The record does not confirm active exploitation, identify a campaign or victim, name a specific exploit, or provide a payload.

Successful exploitation could result in operating-system command execution within the permissions of the web_robot process. This could affect the confidentiality, integrity, or availability of data and services accessible to that process. The record does not state which account runs the process, whether it has elevated privileges, or whether sandboxing is present. The available evidence therefore does not establish whether the flaw can provide complete control of the host.

If exploited, the flaw could allow an attacker to execute operating-system commands with the permissions of the web_robot process. Possible consequences include changing data or configuration that the process can write, accessing data that it can read, or disrupting the service. The actual business effect depends on the service account, network exposure, and isolation controls in the deployment. The record does not provide evidence of a breach, data loss, or a named campaign.

1. Upgrade from the affected releases to a webgjc-confirmed fixed release when one is provided. The record does not identify a fixed version, so do not assume that any later release is safe.
2. Until a confirmed fix is available, restrict access from untrusted networks to the web_robot interface where operationally feasible. This is a precautionary measure, not a vendor-confirmed mitigation.
3. Recheck deployments after changes, with particular attention to ensuring that case_name is no longer passed directly into operating-system command execution.

• Inventory deployed web_robot instances and compare their running releases with the affected branches listed in affected_summary.
• Check deployments for py/web.py and the controller_listen and controller_recover functions, then identify where case_name is received and passed onward.
• Review request and application logs associated with case_name, including unusual requests or processing errors involving that argument.
• Review process telemetry for unexpected child-process creation or operating-system command execution by web_robot. This is precautionary monitoring, not a confirmed indicator of compromise.
• The record supplies no specific IOC. The absence of matching log evidence does not demonstrate that a system is safe.