SHIRASAGI: Authenticated OS Command Injection and Stored XSS Fixed in v1.21.1

1. Basic Information

• Article Title: Multiple vulnerabilities in SHIRASAGI
• Publisher: JVN (Japan Vulnerability Notes)
• Publication Date: 2026-11-05
• Original Source: JVN#55454512
• Related Sources: SHIRASAGI Project advisory, JVN English advisory
• Related Malware: None identified
• Related Threat Actor: None identified
• Related CVE: CVE-2026-117679, CVE-2026-118869
• Affected Products: SHIRASAGI v1.12.0–v1.21.0 for XSS Case 1; v1.19.0–v1.21.0 for XSS Case 2 and OS command injection
• Severity: High

2. Executive Summary

SHIRASAGI v1.21.1 fixes two vulnerabilities with different privileges, triggers, and execution locations.

CVE-2026-118869 is OS command injection affecting v1.19.0–v1.21.0. An authenticated user with the required open-data dataset and harvest-management permissions can save a crafted import URL and run the import to execute OS commands on the server.

CVE-2026-117679 is stored cross-site scripting. An authenticated user with advertisement-management permissions can save a malicious advertisement configuration. Script execution requires another user to click the advertisement. Case 1 affects v1.12.0–v1.21.0; Case 2 affects v1.19.0–v1.21.0.

The inspected advisories do not report exploitation in real attacks.

3. Attack Flow

Different Privileges, Triggers, and Execution Locations

CVE-2026-118869: OS Command Injection

1. The attacker signs in with an account allowed to manage datasets and harvesting on a properly configured open-data site.
2. The attacker saves a crafted value in the harvest-import URL setting.
3. Running the dataset import can cause OS commands to execute on the server.
4. Inference: Further file changes or credential access may be possible within the executing process's privileges. Such follow-on activity was not reported as observed compromise.

The import operation is performed by the authenticated attacker. The CVSS UI:N value means that additional victim interaction is not required; it does not mean that no operation is needed to trigger the vulnerable function.

CVE-2026-117679: Stored XSS

1. An authenticated user with advertisement-management permissions saves malicious content in the advertisement's additional attributes for Case 1, or its link-display setting for Case 2.
2. Another user visits a page displaying the advertisement and clicks it. Viewing the page alone is not the trigger described by the vendor.
3. The saved script executes in that user's browser.

The impact on sessions and user actions depends on the browser context, the user's privileges, and protections such as HttpOnly cookies. Cookie theft or complete account takeover is not an automatic consequence.

4. Threat Actor Location and Execution Site

• Attacker Position: An authenticated internal or external attacker who can reach the management interface and has the permissions required for the specific feature.
• OS Command Injection: Executes on the server running SHIRASAGI. The advisory does not identify the exact executing OS account.
• Stored XSS: Executes in the browser of the user who clicks the crafted advertisement.

Advertisement-management permissions should not be treated as equivalent to dataset and harvest-management permissions.

5. Victim and Administrator Visibility

Victim

After clicking an advertisement, a user might see unexpected script behavior, a popup, or an unintended navigation. Visible symptoms are not guaranteed.

Administrator

• Configuration history may show unusual advertisement attributes, link-display values, or harvest-import URLs.
• Inference: Where process auditing is enabled, unexpected application child processes, command execution, file changes, or outbound connections may provide evidence of server-side exploitation.
• These are investigation opportunities, not logs reported from an observed victim incident.

6. Success and Failure Conditions

Affected Versions and Controls

Success Conditions

• The relevant affected version and feature are present.
• For command injection, the attacker has dataset and harvest-management permissions and runs the import after saving the crafted URL.
• For XSS, the attacker can save the affected advertisement setting and another user clicks the advertisement.

Conditions That Prevent or Reduce Exploitation

• Apply v1.21.1 or the relevant fixes listed by the vendor.
• Limit management-interface access and minimize feature-specific privileges. These controls reduce opportunities but do not make a vulnerable feature safe from an authorized or compromised account.
• WAF rules, input validation, and browser protections may reduce some payloads or consequences. Their effectiveness depends on implementation and configuration.

Do not assume that CSP blocks server-side command injection or every external navigation, or that a WAF signature replaces the software fix.

7. What Happens Upon Success

• CVE-2026-118869: OS commands can execute on the server with the privileges of the executing process. Further effects depend on those privileges and the environment.
• CVE-2026-117679: JavaScript can execute in the browser of a user who clicks the advertisement. Session misuse or unintended actions may follow, depending on browser protections and user privileges.

Neither the advisories nor these possible consequences establish an observed victim compromise.

8. Observable Logs

The following are possible evidence sources for local investigations. Collection and visibility depend on the deployment.

• Email: No specific email evidence was identified in the advisories.
• Proxy / SWG / DNS: Suspicious management requests and unexpected outbound connections from the application host.
• Endpoint / EDR: Application process trees, unexpected shells or utilities, and changes beneath the web root or other accessible paths.
• Identity / IdP: Unusual management logins, source addresses, access times, and use of delegated or contractor accounts, where authentication auditing exists.
• SaaS / Cloud: Hosting or container-platform audit records and access to secrets.
• Network: Requests to management functions followed by unexpected outbound connections.

Saved configuration history may be more useful than a URL-only signature. A malicious setting can be stored before a later click or import triggers it.

9. Determining Attack Success

These are assessment criteria for an organization's own environment.

• Attempt Observed; Success Unconfirmed: A crafted URL or advertisement-setting request is present, but there is no evidence of command or script execution.
• Initial Execution Confirmed: Evidence links the affected function to OS-command execution on the server or script execution in the viewer's browser.
• Follow-On Compromise: Assess file changes, credential access, session misuse, and other effects separately.

A completed harvest job or a suspicious advertisement setting alone does not prove compromise. The vendor's reproduction procedures are not evidence of exploitation against third-party victims.

10. Investigation Playbook

• Trigger: An affected version, suspicious management changes, or unexpected application child processes.
• Initial Checks: Confirm the version, applied fixes, feature configuration, account permissions, management-interface exposure, and available access records.
• Configuration Review: Inspect saved advertisement additional attributes, link-display values, and harvest-import URLs through supported administrative or forensic methods.
• Host Investigation: Preserve relevant process trees, file changes, credential-store access, and outbound connections.
• Identity Review: Examine management logins, sessions, permission changes, and contractor-account activity.
• Follow-On Investigation: Look for unauthorized files, accounts, services, credential access, or browser-session misuse where evidence warrants it.
• Containment: Apply the fix, restrict management access, revoke suspicious sessions or accounts, and isolate the server if compromise is suspected.
• Classification: Distinguish a vulnerable deployment, an attempt, browser script execution, server command execution, and follow-on compromise.

11. Defense and Detection Ideas

These are defensive proposals, not observations from a reported attack campaign.

• Process Detection: Investigate unexpected shell or system-utility launches by the SHIRASAGI application.
• Correlation: Link management login, advertisement or harvest-setting changes, and subsequent command execution or advertisement clicks.
• Hunting: Inventory affected instances, externally reachable management interfaces, dormant accounts, and excessive delegated permissions.
• Configuration Auditing: Retain changes to the settings identified in the vendor's reproduction procedures.
• Priority Controls: Apply v1.21.1, separate the management interface from public access, minimize permissions, and use appropriate authentication and host-monitoring controls.
• Detection Limits: A static WAF rule may miss stored configuration changes and later triggers. Browser-side execution may also be absent from server logs.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-117679 is stored XSS requiring advertisement-management permissions and another user's advertisement click.
• Case 1 involves additional attributes and affects v1.12.0–v1.21.0. Case 2 involves link-display settings and affects v1.19.0–v1.21.0.
• CVE-2026-118869 is OS command injection affecting v1.19.0–v1.21.0. It requires configured open data, dataset and harvest-management permissions, and import execution after saving a crafted URL.
• Both vulnerabilities are fixed in v1.21.1.
• The vendor published reproduction procedures and fix commits. The inspected advisories do not report exploitation in real attacks.

Inference

• Compromise of an account with dataset and harvest-management permissions could lead to server-side command execution.
• Compromise of an account with advertisement-management permissions could enable browser-side XSS against users who click the advertisement.
• These are distinct privilege paths. Advertisement-editing rights alone do not establish access to the command-injection path.

Hypothesis

No additional hypotheses. Unconfirmed matters are listed under "Open Questions and Further Investigation".

13. MITRE ATT&CK Mapping

14. Open Questions and Further Investigation

• The exact OS account and privileges used for command execution were not disclosed in the inspected advisories.
• Exploitation against real victims and any follow-on damage remain unconfirmed.
• Published reproduction procedures should not be treated as incident evidence.

15. Impact on SOCs and Organizations

SHIRASAGI is a Japanese CMS used by municipalities, universities, public institutions, and businesses in Japan. This deployment context is relevant, but the required action applies to any organization running an affected version.

Organizations should review management-interface exposure and delegated permissions, apply v1.21.1 or the relevant vendor fixes, and audit earlier configuration changes and execution records. Server-side command injection and browser-side XSS require different evidence and should be investigated separately.

16. Summary by Role

• SOC: Correlate unusual management activity, advertisement or harvest-setting changes, and evidence of server commands or browser script execution.
• Administrators: Apply v1.21.1 or the vendor-listed fixes, review feature-specific permissions, and restrict management access.
• Users: Stop interacting with unexpected page behavior or redirects and report them to the administrator.