PT-2025-7632 · Unknown · Binance-Trading-Bot

Kwstubbs · Published 2025-02-21 · Updated 2025-02-26 · CVE-2025-27106

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions binance-trading-bot versions prior to 0.0.100

Description The binance-trading-bot is an automated Binance trading bot with a trailing buy/sell strategy. Authenticated users can achieve Remote Code Execution on the host system due to a command injection vulnerability in the "/restore" endpoint. The name of the uploaded file is passed to shell.exec without sanitization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine.

Recommendations For versions prior to 0.0.100, upgrade to version 0.0.100 or later to address the issue. As a temporary workaround, consider restricting access to the "/restore" endpoint until the issue is resolved. Avoid using the shell.exec function with unsanitized input from uploaded files.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-27106

GHSA-WQ6J-4388-4GG5

Affected Products

Binance-Trading-Bot

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27106.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27106 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27106 · Vendor Advisory
• https://github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96784d9/app/frontend/webserver/handlers/restore-post.js#L14 · Note
• https://github.com/chrisleekr/binance-trading-bot/security/advisories/GHSA-wq6j-4388-4gg5 · Note
• https://github.com/chrisleekr/binance-trading-bot/commit/99d464cf8ef858d441189993054ec5f5f86e6213 · Note
• https://t.me/cvenotify/112154 · Telegram Post
• https://twitter.com/cracbot/status/1894704106788487612 · Twitter Post
• https://t.me/latest_high_impact_cve/1865 · Telegram Post
• https://twitter.com/cybercronai/status/1893533930231398514 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1893075696836071804 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1893074540382580928 · Twitter Post
• https://twitter.com/CVEnew/status/1893052223694729616 · Twitter Post
• https://t.me/cvedetector/18691 · Telegram Post
• https://twitter.com/CVETracker/status/1893390496749207931 · Twitter Post