CyberRota Analysis
AI-GeneratedThe `record-output` parameter in the `/instances/$name/exec` endpoint of Incus versions prior to 7.2.0 is vulnerable to arbitrary command execution due to improper handling of symlinks, allowing attackers to write output files to unintended locations. This critical vulnerability, with a CVSS score of 9.9, can lead to unauthorized access and manipulation of system files. Organizations using affected versions of Incus should prioritize upgrading to version 7.2.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.