Command Injection via Unquoted SFTP Password

mercure is an open-source DICOM orchestration platform; we appreciate the maintainers' prompt, constructive response to this report. mercure can dispatch processed studies to an SFTP target, and the web interface offers a "Test" button to check the connection.

The SFTP test builds an sshpass command and interpolates the configured password into it without quoting:

async def test_connection(self, target: SftpTarget, target_name: str):
    ping_result, *_ = await async_run(f"ping -w 1 -c 1 {target.host}")
    # ...
    command = "sftp -o StrictHostKeyChecking=no " + f''' "{target.user}@{target.host}:{target.folder}" <<< "" '''
    if target.password:
        command = f"sshpass -p {target.password} " + command    # unquoted injection
    logger.debug(command)                                        # password logged at DEBUG
    result, stdout, stderr = await async_run(command, shell=True, executable="/bin/bash")

async_run() runs the string through a shell, so $(...) command substitution in the password is evaluated before sshpass even runs:

async def async_run(cmd, **params) -> Tuple[Optional[int], bytes, bytes]:
    proc = await asyncio.create_subprocess_shell(
        cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, **params
    )
    stdout, stderr = await proc.communicate()
    return proc.returncode, stdout, stderr

An administrator who sets the SFTP password to a value containing command-substitution syntax and clicks Test runs that command as the mercure user; sshpass then receives an empty password and the connection fails, but the injected command has already run. The test endpoint requires only an authenticated session, so any logged-in user can trigger a stored malicious target. We are not publishing a working payload.

Only the test path is exploitable. The actual file-dispatch path builds the command as a list (via shlex.split), which neutralizes the injection. The remaining target fields are covered in the unquoted target-field advisory.

The rsync handler shows the safe pattern: it passes the password as a list element and executes with async_run_exec() (no shell).

sshpass_cmd=["sshpass", "-p", target.password],    # list, no shell interpretation

Command execution as the mercure user is confirmed by the output of an injected id:

uid=1000(mercure) gid=1000(mercure) groups=1000(mercure)