PT-2022-9366 · Lens · Lens

Eren Karahasan · Published 2022-01-10 · Updated 2022-01-18 · CVE-2021-23154

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lens versions prior to 5.3.4

Description The issue allows custom helm chart configuration to create helm commands from string concatenation of provided arguments, which are then executed in the user's shell. This can be exploited by providing arguments that cause arbitrary shell commands to run on the system.

Recommendations For Lens versions prior to 5.3.4, update to version 5.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom helm chart configuration to minimize the risk of exploitation. Avoid providing arguments that could be used to execute arbitrary shell commands.

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2021-23154

Affected Products

Lens

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-23154 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23154 · Vendor Advisory
• https://github.com/Mirantis/security/blob/main/advisories/0003.md · Note
• https://t.me/cvenotify/25167 · Telegram Post