PT-2024-34062 · Consoleme · Consoleme
Jay Dhulia
·
Published
2024-05-16
·
Updated
2024-05-17
·
CVE-2024-5023
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
ConsoleMe versions prior to 1.4.0
Description:
The issue is related to Command Injection, where authenticated users can achieve limited Remote Code Execution (RCE) in ConsoleMe, restricted to flag inputs on a single CLI command. However, it is unlikely that full RCE is possible due to this constraint. A specific flag allows authenticated users to read any server files accessible by the ConsoleMe process, which could potentially be exploited for privilege escalation. This issue affects deployments of ConsoleMe that allow templated resources. The self-service flow for templated resources in ConsoleMe accepts a user-supplied JSON post body, which includes the filename for the templated resource. However, this user-supplied filename is not properly sanitized and is passed directly as a string to a CLI command.
Recommendations:
To resolve the issue, update to version 1.4.0 or later. If you are unable to upgrade to the latest version, users can selectively apply the code changes in the provided pull request. Alternatively, removing the configuration item
cache resource templates.repositories or adding it as an empty array should mitigate the issue, but will result in broken functionality (templated resources will no longer be supported for self-service). As a temporary workaround, consider restricting access to templated resources until a patch is applied.Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Consoleme