Unauthenticated OS command injection via nmap/gobuster target parameters

Summary

hexstrike_server.py's Flask API binds to 0.0.0.0 with no authentication anywhere in the code. Multiple tool endpoints, at minimum /api/tools/nmap and /api/tools/gobuster, build their shell command line by directly interpolating client-supplied JSON fields (target, url, ports, wordlist) into an f-string before running it via subprocess.Popen(command, shell=True, ...). A target/url value containing shell metacharacters runs as a separate command.

Affected: current master (v6.0), commit d689933ff579d839c676c82b231f8e98326c5f04.

Details

/api/tools/nmap:

command = f"nmap {scan_type}"
if ports:
    command += f" -p {ports}"
if additional_args:
    command += f" {additional_args}"
command += f" {target}"

/api/tools/gobuster:

command = f"gobuster {mode} -u {url} -w {wordlist}"

Neither target, url, ports, nor wordlist is quoted or validated before interpolation, so ; , backticks, or $() in any of them breaks out of the intended tool invocation. Combined with the complete absence of authentication and the default 0.0.0.0 bind, this is unauthenticated remote code execution for anyone who can reach the API port.

POC

(available upon request)

Impact

Anyone who can reach the HexStrike API port gets unauthenticated remote code execution as the process user, with no credentials or prior interaction required. This includes any deployment on a shared host, container, or cloud VM where the port isn't independently firewalled off, and any MCP client with network access to a HexStrike instance meant to be used only by a trusted agent. The same f-string-into-shell=True pattern is present across the other /api/tools/* endpoints in this file (90 total via @app.route("/api/tools/), not just these two.