Summary

An authenticated Bastillion user can inject shell metacharacters through SSH key metadata and trigger arbitrary command execution on managed target hosts during key distribution. This is a command injection vulnerability in the key deployment path and can lead to full compromise of managed systems reachable by Bastillion.

Details

The vulnerable flow is:

1. User-controlled key name (publicKey.keyNm) is accepted from /admin/savePublicKey.ktrl:

• src/main/webapp/admin/view_keys.html:223

2. keyNm is embedded into generated public-key comment (username@keyname) without shell-safe validation:

• [src/main/java/io/bastillion/manage/control/AuthKeysKtrl.java:262](https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/io/bastillion/manage/control/
  AuthKeysKtrl.java#L262)
• [src/main/java/io/bastillion/manage/control/AuthKeysKtrl.java:327](https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/io/bastillion/manage/control/
  AuthKeysKtrl.java#L327)

3. That string is concatenated into a remote shell command in SSHUtil.addPubKey():

• src/main/java/io/bastillion/manage/util/SSHUtil.java:220

The command is built as:
echo '<newKeys>' > <authorized_keys_path>; chmod 600 <authorized_keys_path>

Because <newKeys> can contain a single quote (') and shell separators (;), an attacker can break out of the quoted string and execute arbitrary commands.

Default config enables this path:

• keyManagementEnabled=true
• forceUserKeyGeneration=true
• src/main/resources/BastillionConfig.properties:39
• src/main/resources/BastillionConfig.properties:41

PoC

Prerequisites:

• Bastillion running with default key-management settings.
• Authenticated user with access to /admin/savePublicKey.ktrl and at least one assigned managed host.

Steps:

1. Log in.
2. Go to Manage SSH Keys and add a new key.
3. Set Key Name to:
   demo'; touch /tmp/bastillion_real_proof; #
4. Submit key creation/saving.
5. Bastillion distributes keys and executes a command equivalent to:
   echo 'ssh-ed25519 ... alice@demo'; touch /tmp/bastillion_real_proof; #' > .ssh/authorized_keys; chmod 600 .ssh/authorized_keys
6. On the managed target host, verify:
   ls -l /tmp/bastillion_real_proof

Proof observed in local command-construction harness:

• Constructed command contained injected ; touch /tmp/bastillion_real_proof;
• File /tmp/bastillion_real_proof was created successfully.

Impact

This is OS command injection (CWE-78) that allows authenticated users to run arbitrary shell commands on managed remote hosts under the SSH account Bastillion uses for that host. Depending on remote account privileges, this can result in full host compromise, persistence, data theft, or lateral movement.