CVE-2026-47668 — DbGate /runners/start Code Injection (Unauthenticated RCE)

Key facts

CVE-2026-47668 is a Critical (10.0) vulnerability: DbGate /runners/start Code Injection (Unauthenticated RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-47668
Severity	Critical (10.0)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-47668/

Details

CVE-2026-47668 is a Critical (10.0) vulnerability: DbGate /runners/start Code Injection (Unauthenticated RCE). This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

CVSS v3	10.0 (Critical)
CWE	CWE-20 Improper Input Validation → code injection
Affected	DbGate ≤ 7.1.8
Fixed	7.1.9
Vector	Network / Unauthenticated

For authorized security testing, CTF, and research only.

Summary

DbGate's JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source via string concatenation, and the generated code is then executed in a forked Node.js child process. An unauthenticated attacker who can reach the runner can execute arbitrary code on the host.

Root cause

User input flows into generated source code unvalidated:

generated = "async function run() { const x = " + functionName + "(); ... }"

Any functionName that isn't a plain identifier (e.g. require('child_process').execSync('…')//) breaks out of the intended call and runs as code. The fix (7.1.9) validates the identifier before interpolation.

Detection (poc.py)

Non-destructive: submits a runner script whose functionName injects a benign arithmetic marker (no OS/process access). If the server evaluates the injected expression (marker reflected in the result), it is VULNERABLE. The PoC never injects shell/process payloads.

python poc.py --target http://TARGET:5001

Lab

docker compose up --build      # vulnerable on :5001, patched on :5002
./run-tests.sh

Remediation

• Upgrade to DbGate 7.1.9+.
• Never expose the runner endpoint unauthenticated; validate functionName against a strict identifier allowlist.
• Apply the prevention/ rules to block injection payloads at the edge.

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-47668, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-47668 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2026-47668 — DbGate /runners/start code injection (Snort/Suricata)

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-47668 DbGate runner code injection (require/child_process in functionName)"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/runners/start"; \
    http.request_body; content:"functionName"; nocase; \
    http.request_body; pcre:"/require\s*\(|child_process|process\.|Function\s*\(/i"; \
    classtype:web-application-attack; sid:2026047668; rev:1; )

alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"CVE-2026-47668 DbGate runner invocation from external source"; \
    flow:established,to_server; http.method; content:"POST"; \
    http.uri; content:"/runners/start"; \
    classtype:web-application-activity; sid:2026047669; rev:1; )

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-47668 — DbGate /runners/start code injection
 * Detect the runner exploit payload and Node.js command-exec artifacts dropped
 * through the generated child process.
 */

rule CVE_2026_47668_dbgate_runner_injection
{
    meta:
        cve = "CVE-2026-47668"
        description = "DbGate JSON runner code-injection payload"
        severity = "critical"
    strings:
        $fn = "functionName" ascii
        $assign = "assign" ascii
        $p1 = "child_process" ascii
        $p2 = "require(" ascii
        $p3 = "execSync" ascii nocase
        $p4 = "Function(" ascii
    condition:
        $fn and $assign and any of ($p1, $p2, $p3, $p4)
}

:material-file-download: prevention/yara.yar

# CVE-2026-47668 — DbGate /runners/start code injection
# Restrict the runner endpoint and block obvious code-injection payloads at the edge.

location /runners/ {
    # The script runner must never be internet-facing.
    allow 10.0.0.0/8;          # <- adjust to trusted ops network
    deny  all;

    # Block functionName payloads that aren't plain identifiers (require/child_process/etc.).
    if ($request_body ~* "(require\s*\(|child_process|process\.|global\.|\beval\b|\bFunction\s*\()") {
        return 403;
    }
    client_body_in_single_buffer on;
    proxy_pass http://127.0.0.1:5001;
    proxy_set_header Host $host;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-47668 — DbGate /runners/start code injection (Apache + ModSecurity)

# Restrict the runner endpoint to the trusted ops network.
<LocationMatch "^/runners/">
    Require ip 127.0.0.1 10.0.0.0/8    # <- adjust
</LocationMatch>

# Block code-injection payloads in the runner request body.
SecRule REQUEST_URI "@beginsWith /runners/start" \
    "id:2026047668,phase:2,deny,status:403,log,\
     msg:'CVE-2026-47668 DbGate runner code injection',chain"
    SecRule REQUEST_BODY "@rx (require\s*\(|child_process|process\.|global\.|\beval\b|Function\s*\()" "t:none"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-47668?

CVE-2026-47668 is a Critical (10.0) vulnerability: DbGate /runners/start Code Injection (Unauthenticated RCE). This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-47668?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-47668?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

---

For authorized security testing and research only. See the full source and NVD record.