Description
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
beenuar AiSOC
Default version status: unaffected
7.2.0 to < 12.0.0affected
References
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7 ↗
- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2 ↗
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0 ↗
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py#L273 ↗
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/executors/endpoint.py#L442 ↗
- https://www.vulncheck.com/advisories/aisoc-7.2.0-before-12.0.0-command-injection-via-crowdstrike-rtr ↗