Malcolm
Monthly
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the operator into loading attacker-controlled web content force that operator's browser to fire unauthenticated management commands at the kiosk's POST /script_call/<script> endpoint. Successful abuse yields high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N), because the reachable commands are destructive rather than data-stealing - most notably control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which blinds security monitoring. The endpoint ships with zero authentication and wildcard CORS (CORS(app)) in its default state, so no server-side misconfiguration is required; the only real barrier is inducing the specific operator to render a malicious page (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the archive/PCAP upload path (authenticated, low-privilege per the CVSS PR:L vector) to exhaust filesystem inodes and metadata on the filebeat processing container by submitting a small malicious archive containing an enormous number of directory or file entries, denying service to the processing pipeline and to any service sharing the same mount. safe-extract.py in all versions before 26.07.0 places no limit on entry count, directory depth, total entries, or output size, so the failure is a pure availability impact with no confidentiality or integrity loss (VC:N/VI:N/VA:H). Version 26.07.0 fixes the issue, the EPSS score is a low 0.25% (16th percentile), the CISA SSVC assessment records proof-of-concept exploitation with Automatable set to no, and there is no CISA KEV listing, making this a genuine but moderate-priority availability defect rather than a critical emergency.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-encoding them, bypassing the nginx Lua role-based access control gate that inspects the raw, undecoded request URI. The flaw affects Malcolm installations using its default nginx plus Lua RBAC reverse-proxy front end (CWE-863; CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), where a request such as /%68tadmin.php is routed by nginx's decoded-URI location matching into the restricted location while the Lua check sees no matching restriction and grants access. Exploitation requires a working authenticated account - there is no pre-auth path - and no public exploit code was identified at time of analysis; the issue was reported through CISA's ICS-CERT process (ICSA-26-280-01).
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Docker volume by submitting a small single-stream compressed file (e.g., .gz, .bz2, .xz, .lzma, .lz) that decompresses to an effectively unbounded size. The flaw, CWE-409 decompression bomb, bypasses the entry-count, nesting-depth, and uncompressed-byte limits that scripts/safe-extract.py applies only to container archives (zip/tar/rar/7z via libarchive), causing disk exhaustion that disrupts OpenSearch, Logstash, Arkime, and Zeek for all users. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation requires valid credentials with upload permissions and results in availability impact only (CVSS 6.5).
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Malcolm deployment reach the bundled Arkime live-capture service directly on TCP port 8005 and impersonate arbitrary users, gaining full administrative access to the Arkime viewer. The issue stems from documented default configuration: the arkime-live container runs with network_mode: host and binds the viewer to 0.0.0.0 (viewHost), Arkime trusts the X-Forwarded-User header from any source IP (userAuthIps=::,0.0.0.0/0) with automatic user creation, and the passwordSecret is the hardcoded public value 'Malcolm'. Exploitation is unauthenticated and requires no user interaction, but it does require adjacency to a network segment the Malcolm host is attached to, because the attacker must connect to port 8005 directly and bypass the nginx front end; deployments that block 8005, restrict userAuthIps, or change the passwordSecret are not exploitable by this path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); CISA's ICS assessment publishes a base score of 4.2, while our independent assessment rates confidentiality impact as High (unauthenticated reads of captured traffic and viewer data) for a materially higher score.
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach the Arkime backend and assume arbitrary identities by requesting the 'Dashboards -> Arkime shortcut' path with any path segment that is not exact-lowercase (for example /IDDASH2ARK/...). The location's case-insensitive regex matcher fires, but the case-sensitive rewrite does not issue the intended redirect, so nginx falls through to the one proxied location in the shipped configuration that omits the per-location authentication file; that same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured as shipped to trust that header as the authenticated username, enabling forged, auto-provisioned identities. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-290) with no credentials or user interaction required; no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and practical risk is moderate because it is bounded mainly by network reachability of the front proxy - instances not exposed beyond trusted segments have reduced exposure.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the operator into loading attacker-controlled web content force that operator's browser to fire unauthenticated management commands at the kiosk's POST /script_call/<script> endpoint. Successful abuse yields high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N), because the reachable commands are destructive rather than data-stealing - most notably control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which blinds security monitoring. The endpoint ships with zero authentication and wildcard CORS (CORS(app)) in its default state, so no server-side misconfiguration is required; the only real barrier is inducing the specific operator to render a malicious page (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the archive/PCAP upload path (authenticated, low-privilege per the CVSS PR:L vector) to exhaust filesystem inodes and metadata on the filebeat processing container by submitting a small malicious archive containing an enormous number of directory or file entries, denying service to the processing pipeline and to any service sharing the same mount. safe-extract.py in all versions before 26.07.0 places no limit on entry count, directory depth, total entries, or output size, so the failure is a pure availability impact with no confidentiality or integrity loss (VC:N/VI:N/VA:H). Version 26.07.0 fixes the issue, the EPSS score is a low 0.25% (16th percentile), the CISA SSVC assessment records proof-of-concept exploitation with Automatable set to no, and there is no CISA KEV listing, making this a genuine but moderate-priority availability defect rather than a critical emergency.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-encoding them, bypassing the nginx Lua role-based access control gate that inspects the raw, undecoded request URI. The flaw affects Malcolm installations using its default nginx plus Lua RBAC reverse-proxy front end (CWE-863; CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), where a request such as /%68tadmin.php is routed by nginx's decoded-URI location matching into the restricted location while the Lua check sees no matching restriction and grants access. Exploitation requires a working authenticated account - there is no pre-auth path - and no public exploit code was identified at time of analysis; the issue was reported through CISA's ICS-CERT process (ICSA-26-280-01).
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Docker volume by submitting a small single-stream compressed file (e.g., .gz, .bz2, .xz, .lzma, .lz) that decompresses to an effectively unbounded size. The flaw, CWE-409 decompression bomb, bypasses the entry-count, nesting-depth, and uncompressed-byte limits that scripts/safe-extract.py applies only to container archives (zip/tar/rar/7z via libarchive), causing disk exhaustion that disrupts OpenSearch, Logstash, Arkime, and Zeek for all users. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation requires valid credentials with upload permissions and results in availability impact only (CVSS 6.5).
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Malcolm deployment reach the bundled Arkime live-capture service directly on TCP port 8005 and impersonate arbitrary users, gaining full administrative access to the Arkime viewer. The issue stems from documented default configuration: the arkime-live container runs with network_mode: host and binds the viewer to 0.0.0.0 (viewHost), Arkime trusts the X-Forwarded-User header from any source IP (userAuthIps=::,0.0.0.0/0) with automatic user creation, and the passwordSecret is the hardcoded public value 'Malcolm'. Exploitation is unauthenticated and requires no user interaction, but it does require adjacency to a network segment the Malcolm host is attached to, because the attacker must connect to port 8005 directly and bypass the nginx front end; deployments that block 8005, restrict userAuthIps, or change the passwordSecret are not exploitable by this path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); CISA's ICS assessment publishes a base score of 4.2, while our independent assessment rates confidentiality impact as High (unauthenticated reads of captured traffic and viewer data) for a materially higher score.
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach the Arkime backend and assume arbitrary identities by requesting the 'Dashboards -> Arkime shortcut' path with any path segment that is not exact-lowercase (for example /IDDASH2ARK/...). The location's case-insensitive regex matcher fires, but the case-sensitive rewrite does not issue the intended redirect, so nginx falls through to the one proxied location in the shipped configuration that omits the per-location authentication file; that same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured as shipped to trust that header as the authenticated username, enabling forged, auto-provisioned identities. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-290) with no credentials or user interaction required; no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and practical risk is moderate because it is bounded mainly by network reachability of the front proxy - instances not exposed beyond trusted segments have reduced exposure.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.