CyberRota Analysis
AI-GeneratedThe Nuclio dashboard in Docker versions prior to 1.17.4 is vulnerable to unauthenticated OS command injection due to improper handling of the resourceNamespace parameter in the list-all resource path. An attacker can exploit this vulnerability by injecting shell metacharacters through specific HTTP headers, potentially leading to arbitrary command execution within the dashboard container. Organizations using affected versions of Docker with Nuclio should prioritize upgrading to version 1.17.4 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.