MS SWIFT WEB-UI RCE Vulnerability

链接： https://github.com/advisories/GHSA-7c78-rm87-5673

仓库 Star： 9003

参考链接：

描述：

I. Detailed Description:

  1. Install ms-swift

    1
    pip install ms-swift -U

  2. Start web-ui

    1
    swift web-ui --lang en

  3. After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program

  4. Fill in necessary parameters
    In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The –output_dir can be filled arbitrarily as it will be modified later through packet capture

  5. Click Begin to start training. Capture packets and modify the parameter corresponding to –output_dir

    You can see the concatenated command being executed in the terminal where web-ui was started

  6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files

II. Vulnerability Proof:

1
/tmp/xxx'; touch /tmp/inject_success_1; #

III. Fix Solution:

  1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend
  2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2…]) format

Author

安全公告
#Github Advisory
MS SWIFT WEB-UI RCE Vulnerability
http://example.com/2025/07/31/github_1485958261/
作者
lianccc
发布于
2025年7月31日
许可协议