Command Injection via the subservice Log Parameter

mercure is an open-source DICOM orchestration platform; we appreciate the maintainers' prompt, constructive response to this report. The web interface includes a log viewer for mercure's services.

When a service's systemd unit is configured as a list (the "workers" service in the default configuration), the log viewer reads a subservice query parameter and interpolates it into a journalctl command run through a shell:

service_name_or_list = services.services_list[requested_service]["systemd_service"]
if isinstance(service_name_or_list, list):
    service_name = request.query_params.get("subservice", "missing")
    # ...
    sub_services = service_name_or_list

run_result = await async_run(
    f"sudo journalctl -n 1000 -u "
    f'{service_name} '
    f"{start_date_cmd} {end_date_cmd} "
    "-o short-iso --no-hostname"
)

async_run() always runs its argument through a shell, so metacharacters in the parameter are interpreted:

async def async_run(cmd, **params) -> Tuple[Optional[int], bytes, bytes]:
    proc = await asyncio.create_subprocess_shell(
        cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, **params
    )
    stdout, stderr = await proc.communicate()
    return proc.returncode, stdout, stderr

A semicolon in the subservice value splits the command; the injected portion runs independently as the mercure user, regardless of whether journalctl succeeds. The endpoint returns 200 and the log view appears empty, so there is no visible indication. We are not publishing a working payload.

This affects systemd installations only. The Docker code path reads the same parameter but passes it to a Docker SDK call rather than a shell, so it is not injectable. On systemd installs the mercure user also holds NOPASSWD sudo for journalctl and systemctl on mercure services, so the injected shell can stop or restart services and read the data and credentials the user owns.

Command execution as the mercure user is confirmed by the output of an injected id:

uid=1000(mercure) gid=1000(mercure) groups=1000(mercure)