← All KD5FMU repositories

announcement-manager

https://github.com/KD5FMU/announcement-manager · Shell/PHP · 8 findings · Review date 2026-07-11

Executive Summary

8 finding(s) including 2 critical. UI gated by Supermon login but backend PHP endpoints are directly reachable; installer grants www-data dangerously broad passwordless sudo.

Compatible with Supermon 6.1 through Supermon 8 and Allmon3 for announcement creation and management of cron entries<br>

Summary Counts

2
Critical Security
2
High Security
3
Medium Security
0
Low Security
0
Critical Bugs
0
High Bugs
1
Medium Bugs
0
Low Bugs

Quick Reference

IDSeverityCategoryFileLinesFinding
ANNOUNCEMENT-MGR-001 Critical Security announcement_manager.sh 537-542 Over-broad passwordless sudo for www-data (cp/chmod/chown as ANY user)
ANNOUNCEMENT-MGR-002 Critical Security upload_mp3.php 1-67 Backend PHP API endpoints lack authentication
ANNOUNCEMENT-MGR-003 High Security announcement.php 164-212 Crontab injection via unvalidated schedule POST fields
ANNOUNCEMENT-MGR-004 High Security 99-supermon-announcements 9-10 Passwordless root crontab management for www-data
ANNOUNCEMENT-MGR-005 Medium Security piper_generate.php 24-60 User-controlled Piper voice model path passed to shell script
ANNOUNCEMENT-MGR-006 Medium Security announcement_manager.sh 205-206 Unquoted audio path in generated playaudio/playglobal scripts
ANNOUNCEMENT-MGR-007 Medium Bug globalplay.php 34-36 escapeshellcmd() applied to entire command strings
ANNOUNCEMENT-MGR-008 Medium Security allmon-announcement-frame.php 19-20 Allmon3 auth check disables TLS certificate verification

Critical Security Issues

[ANNOUNCEMENT-MGR-001] Over-broad passwordless sudo for www-data (cp/chmod/chown as ANY user)

announcement_manager.sh : 537-542

Installer writes /etc/sudoers.d/99-supermon-announcements granting www-data NOPASSWD access to /bin/cp, /bin/chown, and /bin/chmod as ALL users without argument restrictions.

Related: ANNOUNCEMENT-MGR-002

Impact: Remote attacker who can invoke PHP or compromise www-data can copy arbitrary files, change ownership, and modify permissions system-wide as root.

[ANNOUNCEMENT-MGR-002] Backend PHP API endpoints lack authentication

upload_mp3.php : 1-67

PHP action scripts have no session_start() or login check. Only announcement.inc gates the UI.

Related: ANNOUNCEMENT-MGR-004

Impact: Anyone who can reach the web server can upload audio, modify root crontab, trigger playback, and delete files without Supermon login.

High Security Issues

[ANNOUNCEMENT-MGR-003] Crontab injection via unvalidated schedule POST fields

announcement.php : 164-212

Cron lines built directly from $_POST min/hour/dom/month/dow/week without allowlist validation.

Impact: Unauthenticated attacker can persist arbitrary root cron jobs.

[ANNOUNCEMENT-MGR-004] Passwordless root crontab management for www-data

99-supermon-announcements : 9-10

Sudoers grants www-data NOPASSWD /usr/bin/crontab as root.

Impact: Persistent root-level code execution via malicious cron entries.

Medium Issues

[ANNOUNCEMENT-MGR-005] User-controlled Piper voice model path passed to shell script

piper_generate.php : 24-60

Voice model path from POST passed to piper_prompt_tts.sh without path allowlisting.

Impact: API caller could point Piper at attacker-controlled ONNX path.

[ANNOUNCEMENT-MGR-006] Unquoted audio path in generated playaudio/playglobal scripts

announcement_manager.sh : 205-206

Generated scripts embed $1 unquoted inside asterisk -rx strings.

Impact: Asterisk CLI command injection if argument is attacker-controlled.

[ANNOUNCEMENT-MGR-007] escapeshellcmd() applied to entire command strings

globalplay.php : 34-36

Full sudo command strings wrapped in escapeshellcmd() — incorrect PHP escaping pattern.

Impact: Unreliable command execution and potential security bypass.

[ANNOUNCEMENT-MGR-008] Allmon3 auth check disables TLS certificate verification

allmon-announcement-frame.php : 19-20

CURLOPT_SSL_VERIFYPEER and VERIFYHOST disabled for auth check.

Impact: Network attacker could spoof auth check endpoint.

Recommended Fix Priority

  1. Address all Critical findings before production deployment