PT-2026-141865
CVE-2026-97401
·
تاريخ النشر
2026-11-10
·
تاريخ التحديث
2026-11-10
الوصف من
CVSS 4.0
7.4
عاليةالمقاييسAV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In Kura versions <= 5.6.2,
CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAP DAC OVERRIDE, while the configurable "Unprivileged" executor drops to the kura user via su.A caller with permissions
rest.command who is intentionally restricted to unprivileged command execution (privileged.command.service.enable=false, the default) can therefore set workingDirectory to / and use the ZIP body to write or overwrite arbitrary files on the device as kurad, completely bypassing the unprivileged sandbox the operator selected.The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾