Tclahr
Monthly
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 allows an attacker who controls /etc/passwd entries on a target system to execute arbitrary commands on a forensic analyst's host machine. The vulnerability targets the DFIR tool itself rather than the system under investigation: when an analyst runs UAC against a compromised host, crafted usernames or home directory paths containing shell metacharacters are substituted into command strings and passed to eval without sanitization in parse_artifact.sh. This creates a novel attacker-pivots-to-analyst scenario with no public exploit identified at time of analysis, but the attack chain is straightforward given /etc/passwd write access on the investigated system.
Command injection in UAC (Unix-like Artifacts Collector) versions before 3.3.0 allows an attacker who controls evidence under forensic analysis to execute arbitrary commands on the investigating analyst's own host system. The _command_collector function substitutes placeholders such as %user%, %user_home%, and %line% into shell command strings via sed without sanitizing shell metacharacters, then passes the result to eval - enabling malicious filenames or artifact definitions to inject and execute arbitrary shell code on the analyst's workstation. No CISA KEV listing or public exploit code has been identified at time of analysis; vendor patch is available in 3.3.0 per GitHub commit 2cc367d.
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 enables arbitrary command execution on a forensic analyst's workstation when processing evidence containing attacker-controlled data. The root cause is unsafe use of shell `eval` to expand untrusted placeholders - including `%user%`, `%user_home%`, `%line%`, and `%mount_point%` - in the `_run_command` function, allowing shell metacharacters or command substitutions embedded in usernames, filenames, or artifact definitions to execute in the analyst's shell context. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.3.0.
Command injection in Unix-like Artifacts Collector (UAC) pre-3.3.0-rc1 enables arbitrary code execution through unsanitized placeholder substitution in the _run_command() pipeline. Attackers inject shell metacharacters via %line%, %user%, or %user_home% placeholders processed by foreach iterators and system file parsers, exploiting direct eval() execution without input validation. Exploitation requires local access with user interaction but no authentication, executing commands at UAC process privilege level. No public exploit identified at time of analysis.
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 allows an attacker who controls /etc/passwd entries on a target system to execute arbitrary commands on a forensic analyst's host machine. The vulnerability targets the DFIR tool itself rather than the system under investigation: when an analyst runs UAC against a compromised host, crafted usernames or home directory paths containing shell metacharacters are substituted into command strings and passed to eval without sanitization in parse_artifact.sh. This creates a novel attacker-pivots-to-analyst scenario with no public exploit identified at time of analysis, but the attack chain is straightforward given /etc/passwd write access on the investigated system.
Command injection in UAC (Unix-like Artifacts Collector) versions before 3.3.0 allows an attacker who controls evidence under forensic analysis to execute arbitrary commands on the investigating analyst's own host system. The _command_collector function substitutes placeholders such as %user%, %user_home%, and %line% into shell command strings via sed without sanitizing shell metacharacters, then passes the result to eval - enabling malicious filenames or artifact definitions to inject and execute arbitrary shell code on the analyst's workstation. No CISA KEV listing or public exploit code has been identified at time of analysis; vendor patch is available in 3.3.0 per GitHub commit 2cc367d.
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 enables arbitrary command execution on a forensic analyst's workstation when processing evidence containing attacker-controlled data. The root cause is unsafe use of shell `eval` to expand untrusted placeholders - including `%user%`, `%user_home%`, `%line%`, and `%mount_point%` - in the `_run_command` function, allowing shell metacharacters or command substitutions embedded in usernames, filenames, or artifact definitions to execute in the analyst's shell context. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.3.0.
Command injection in Unix-like Artifacts Collector (UAC) pre-3.3.0-rc1 enables arbitrary code execution through unsanitized placeholder substitution in the _run_command() pipeline. Attackers inject shell metacharacters via %line%, %user%, or %user_home% placeholders processed by foreach iterators and system file parsers, exploiting direct eval() execution without input validation. Exploitation requires local access with user interaction but no authentication, executing commands at UAC process privilege level. No public exploit identified at time of analysis.