PT-2026-141865

CVE-2026-97401

Publicado

2026-11-10

Atualizado

2026-11-10

Descrição por

CVSS 4.0

7.4

Alta

MétricasAV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In Kura versions <= 5.6.2, CommandCloudApp.execute() extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as kurad with CAP DAC OVERRIDE, while the configurable "Unprivileged" executor drops to the kura user via su.

A caller with permissions rest.command who is intentionally restricted to unprivileged command execution (privileged.command.service.enable=false, the default) can therefore set workingDirectory to / and use the ZIP body to write or overwrite arbitrary files on the device as kurad, completely bypassing the unprivileged sandbox the operator selected.

The command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.

[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE NOTES.txt#L94

Explorabilidade

Correção

Impactos

Pesquisadores

Alessia Nardotto

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-269: Improper Privilege Management

CWE-73: External Control of File Name or Path