CVE-2026-107780: Critical OS Command Injection in Dromara Skyeye TTS Endpoint — Detection and Remediation Guide

---
title: Dromara Skyeye TTS Command Injection - PowerShell Child Process
id: 3f8a1c92-7d4e-4b5a-9c21-8e6f2a4b7d10
status: experimental
description: Detects PowerShell spawned by Java application processes consistent with exploitation of CVE-2026-107780 in Dromara Skyeye's textToSpeech endpoint, or Skyeye-invoked PowerShell spawning further command interpreters or LOLBins.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107780
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_java:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_suspicious_cl:
    CommandLine|contains:
      - 'textToSpeech'
      - 'Add-Type'
      - 'SpeechSynthesizer'
  condition: selection_parent_java or selection_suspicious_cl
falsepositives:
  - Legitimate Skyeye TTS functionality invoking PowerShell for speech synthesis (rare in production; baseline and tune)
level: high
---
title: Suspicious Child Process of PowerShell Launched by Web Application
id: 9c2e5b17-4a6d-4f83-b1e4-5d7a9c0e2f38
status: experimental
description: Detects reconnaissance, download, and execution tools spawned from PowerShell whose lineage traces to a server-side application, consistent with post-exploitation after CVE-2026-107780 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107780
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1105
  - attack.command_and_control
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_children:
    Image|endswith:
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\quser.exe'
      - '\tasklist.exe'
  condition: all of selection_*
falsepositives:
  - Administrative scripts run interactively via PowerShell; correlate with parent lineage to java.exe/web processes before escalating
level: medium
---
title: HTTP Request to Vulnerable Skyeye textToSpeech Endpoint
id: 5d1a8e64-2b9c-4e71-a3f6-1b8c4d9e5a72
status: experimental
description: Detects web requests targeting the unauthenticated Dromara Skyeye TTS endpoint, particularly POSTs containing quote characters in parameters indicative of CVE-2026-107780 injection attempts. Deploy against web server, reverse proxy, or WAF logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107780
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/post/TtsController/textToSpeech'
  selection_injection:
    cs-method: 'POST'
  condition: selection_uri and selection_injection
falsepositives:
  - Legitimate TTS feature usage; all hits warrant review given unauthenticated reachability of this endpoint
level: high

// Hunt for CVE-2026-107780 exploitation: PowerShell spawned by Java app processes
// and suspicious follow-on command execution on hosts running Dromara Skyeye
let Lookback = 7d;
let SuspiciousChildren = dynamic(["whoami.exe","net.exe","net1.exe","nltest.exe","curl.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","ipconfig.exe","systeminfo.exe","quser.exe"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe")
   and FileName in~ ("powershell.exe","pwsh.exe","cmd.exe")
| project PS_Timestamp = Timestamp, DeviceName, DeviceId,
          PS_ProcessId = ProcessId, PS_CommandLine = ProcessCommandLine,
          JavaCommandLine = InitiatingProcessCommandLine,
          AccountName, ReportId
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ (SuspiciousChildren)
    | project ChildTimestamp = Timestamp, DeviceId,
              InitiatingProcessId, ChildProcess = FileName,
              ChildCommandLine = ProcessCommandLine
) on $left.PS_ProcessId == $right.InitiatingProcessId and $left.DeviceId == $right.DeviceId
| extend ChildProcess = coalesce(ChildProcess, "")
| project PS_Timestamp, DeviceName, AccountName, PS_CommandLine, ChildProcess, ChildCommandLine, JavaCommandLine
| order by PS_Timestamp desc

// Hunt for web requests to the vulnerable endpoint via proxy/firewall logs in Sentinel
let Lookback = 14d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL contains "/post/TtsController/textToSpeech"
   or RequestContext contains "/post/TtsController/textToSpeech"
| extend InjectionIndicator = iff(RequestURL has "'%22" or RequestURL has "%27" or RequestURL has "'", "Possible quote injection", "Clean")
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, InjectionIndicator, DeviceAction
| order by TimeGenerated desc

-- Hunt for PowerShell/cmd processes spawned by Java on Windows hosts
-- (Dromara Skyeye CVE-2026-107780 post-exploitation artifact)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'powershell|pwsh|cmd\.exe'
   OR Name =~ 'powershell|pwsh'

-- Correlate: find PowerShell processes whose parent is java.exe/javaw.exe
LET procs = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime FROM pslist()
SELECT child.Pid AS PID,
       child.Name AS ProcessName,
       child.CommandLine AS CommandLine,
       child.Username AS RunAs,
       parent.Name AS ParentName,
       parent.CommandLine AS ParentCommandLine,
       child.CreateTime AS Started
FROM procs AS child
JOIN procs AS parent ON child.Ppid = parent.Pid
WHERE child.Name =~ '(?i)powershell|pwsh|cmd'
  AND parent.Name =~ '(?i)java'

# CVE-2026-107780 exposure check and hardening for Windows hosts running Dromara Skyeye
# Run elevated on suspected hosts.

# 1. Identify Java processes that may be hosting Skyeye
Write-Host "[*] Java processes running on this host:" -ForegroundColor Cyan
Get-CimInstance Win32_Process -Filter "Name='java.exe' OR Name='javaw.exe'" |
    Select-Object ProcessId, CommandLine |
    Format-List

# 2. Check for Skyeye-related listeners (default ports vary; review all Java-owned sockets)
Write-Host "[*] Listening sockets owned by Java processes:" -ForegroundColor Cyan
$javaPids = (Get-CimInstance Win32_Process -Filter "Name='java.exe' OR Name='javaw.exe'").ProcessId
foreach ($pid_ in $javaPids) {
    Get-NetTCPConnection -State Listen -OwningProcess $pid_ -ErrorAction SilentlyContinue |
        Select-Object LocalAddress, LocalPort, OwningProcess
}

# 3. Search web/access logs for exploitation attempts against the TTS endpoint
$logPaths = @("C:\skyeye\logs", "C:\Program Files\skyeye\logs", "D:\skyeye\logs")
foreach ($path in $logPaths) {
    if (Test-Path $path) {
        Write-Host "[*] Searching $path for textToSpeech requests..." -ForegroundColor Cyan
        Get-ChildItem $path -Recurse -Include *.log -ErrorAction SilentlyContinue |
            Select-String -Pattern "textToSpeech" -SimpleMatch |
            Select-Object -First 50 Path, LineNumber, Line
    }
}

# 4. Audit: PowerShell spawned by Java in the last 14 days (requires process creation auditing / Sysmon)
Write-Host "[*] Checking for PowerShell child processes of Java (Sysmon EID 1)..." -ForegroundColor Cyan
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Id -eq 1 -and $_.Message -match 'ParentImage.*java(w)?\.exe' -and $_.Message -match 'Image.*(powershell|pwsh|cmd)\.exe' } |
    Select-Object TimeCreated, Message -First 20

# 5. Enable PowerShell Script Block Logging for post-exploitation visibility
$sbPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $sbPath)) { New-Item -Path $sbPath -Force | Out-Null }
Set-ItemProperty -Path $sbPath -Name "EnableScriptBlockLogging" -Value 1
Write-Host "[+] Script Block Logging enabled." -ForegroundColor Green

# 6. If Skyeye runs as LocalSystem, create/verify a least-privilege service account
$svc = Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'skyeye|java' -and $_.StartName -match 'LocalSystem' }
if ($svc) {
    Write-Host "[!] WARNING: Service(s) running as LocalSystem — reconfigure to a least-privilege account:" -ForegroundColor Red
    $svc | Select-Object Name, StartName, PathName | Format-List
}

# 7. Block outbound egress from the host to limit payload retrieval (example: deny all except update/mgmt)
# Review before applying — tailor to your environment
# New-NetFirewallRule -DisplayName "Skyeye - Deny Outbound" -Direction Outbound -Program "C:\path\to\java.exe" -Action Block