CVE-2026-45322 in UFO
Summary
by MITRE • 05/28/2026
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.run_shell() passes a command string from action parameters directly to subprocess.Popen() with shell=True and executable=powershell.exe. The same shell-execution behavior is also reachable through ShellReceiver.execute_command(). The shell receiver is invoked by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters to the shell receiver. Because UFO stores planned and executed actions in per-session JSON records, an attacker who can write or modify a session/action JSON file can plant a shell action. When the session is resumed or replayed, UFO executes the attacker's command as the UFO process user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/28/2026
The Microsoft UFO framework represents an open-source intelligent automation solution designed to orchestrate operations across diverse devices and platforms. This framework facilitates automated workflows through session-based action execution where commands are stored in JSON format for later replay. The vulnerability under discussion affects releases up to and including version 3.0.0, specifically targeting the shell action execution pathway within the framework's architecture. The core flaw exists in the ShellReceiver.run_shell() method which directly processes command strings from action parameters without adequate sanitization or validation before passing them to subprocess.Popen() with shell=True parameter. This dangerous execution pattern creates a critical command injection vulnerability that can be exploited by malicious actors.
The technical implementation of this vulnerability stems from the framework's design pattern where action parameters are serialized into JSON session records for storage and later execution. When UFO processes these stored actions during session replay, it invokes ShellReceiver.execute_command() and ShellReceiver.run_shell() methods that execute commands through PowerShell with elevated privileges. The shell=True parameter in subprocess.Popen() enables shell interpretation of command strings, while the executable=powershell.exe argument specifically targets Windows PowerShell execution environment. This combination creates a direct path for arbitrary command execution where attacker-controlled input flows directly into the shell without proper input validation or sanitization mechanisms. The vulnerability manifests when action classes such as RunShellCommand.execute() and ExecuteCommand.execute() forward stored parameters to the vulnerable shell receiver components.
The operational impact of this vulnerability is severe and far-reaching within the context of the UFO framework's deployment environments. An attacker who gains write access to session or action JSON files can inject malicious commands that execute with the privileges of the UFO process user, which typically operates with elevated permissions to perform automation tasks. This privilege escalation capability allows attackers to execute arbitrary code, access sensitive system resources, and potentially compromise the entire automation infrastructure. The vulnerability is particularly dangerous because it leverages the framework's legitimate session replay functionality to deliver malicious payloads, making detection more challenging. The attack vector requires only the ability to modify stored JSON session data, which may be accessible through various attack surfaces including compromised user accounts, insecure file permissions, or other persistence mechanisms within the deployment environment.
Mitigation strategies for this vulnerability should focus on input validation and sanitization at multiple layers within the UFO framework. The most critical immediate fix involves removing or disabling the shell=True parameter in subprocess.Popen() calls and implementing proper command argument parsing rather than direct shell execution. Input validation mechanisms should be implemented to sanitize all command parameters before they reach the shell execution path, with strict whitelisting of allowed characters and command structures. Session data integrity protection measures should be strengthened through cryptographic signing or checksum validation to prevent unauthorized modification of stored action parameters. The framework should also implement privilege separation techniques where automation commands execute with minimal necessary permissions rather than elevated privileges. Additionally, monitoring and logging of shell execution activities should be enhanced to detect anomalous command patterns that may indicate exploitation attempts. This vulnerability aligns with CWE-78 command injection weakness and maps to ATT&CK technique T1059.001 for command and scripting interpreter execution, highlighting the need for comprehensive defensive measures across multiple security domains.