Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization.
This issue has been patched in version 1.15.20.
Attack Parameters
Attack Vector
Network
Атака возможна удалённо
Attack Complexity
Low
Легко эксплуатировать
Attack Requirements
None
Нет дополнительных условий
Privileges Required
None
Права не нужны
User Interaction
None
Не нужно действие пользователя
Impact Assessment
Confidentiality
High
Полная утечка данных
Integrity
High
Полная модификация данных
Availability
High
Полный отказ в обслуживании
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a
security-advisories@github.com
https://github.com/nuclio/nuclio/pull/4030
security-advisories@github.com
https://github.com/nuclio/nuclio/releases/tag/1.15.20
security-advisories@github.com
https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27
security-advisories@github.com