CVE-2026-79898 in BoKS Manager
Summary
by MITRE • 10/01/2026
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Fortra BoKS Manager represents a critical command injection flaw located within the crlserver component, which is responsible for handling Certificate Revocation List operations. This security defect allows an authenticated user who possesses specific privileges to add CRL URLs through various administrative interfaces, including the BCC interface, the WSI REST or SOAP API, or the cacrl command-line tool. The core technical issue stems from insufficient sanitization of input data provided by these authorized users. When a malicious actor supplies specially crafted input containing shell metacharacters, the crlserver process fails to properly validate or escape this data before passing it to underlying system commands. Consequently, the operating system interprets these injected characters as part of legitimate shell syntax, leading to arbitrary command execution within the context of the running service.
The operational impact of this vulnerability is severe due to the privilege level under which the crlserver process operates on the BoKS Master server. Because the component executes with root privileges, successful exploitation grants an attacker full control over the underlying operating system. This effectively results in a complete compromise of the affected host, allowing for data exfiltration, modification of critical configuration files, installation of persistent backdoors, or use of the compromised machine as a pivot point to attack other systems within the network infrastructure. The severity is further amplified by the fact that BCC and WSI provide network-accessible administration paths. Unlike local command-line tools which may be restricted by sudoers rules requiring additional authentication such as suexec, these remote interfaces do not enforce such localized access controls, thereby expanding the potential attack surface to include any authenticated user with network connectivity who holds the requisite permissions for CRL management tasks.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The lack of input validation allows external data to influence the execution flow of system commands directly. In terms of adversary behavior mapping according to MITRE ATT&CK, this flaw facilitates Initial Access through valid accounts and enables Privilege Escalation from a standard administrative user context to root-level privileges without requiring additional exploitation steps beyond the injection itself. It also supports lateral movement capabilities once the initial foothold is established on the BoKS Master node.
Mitigation strategies should focus primarily on applying vendor-provided patches that address the input validation logic within crlserver immediately upon availability. In environments where patching cannot be implemented instantly, network segmentation controls must be enforced to restrict access to the BCC and WSI interfaces exclusively from trusted management subnets or jump hosts with strict identity verification. Additionally, implementing robust Web Application Firewalls can help detect and block common command injection patterns in HTTP requests targeting these APIs. It is also advisable to review user permissions within BoKS Manager to ensure that only essential personnel have access to CRL URL modification functions, adhering to the principle of least privilege. Regular auditing of administrative logs for unusual activity related to certificate management operations can aid in early detection of exploitation attempts.