| शीर्षक | GitHub Pulse <= 6.0.4 Improper Input Validation / Remote Code Execution |
|---|
| विवरण | A vulnerability in the Quick Security Setup handler (/api/security/quick-setup) of rcourtman/Pulse (versions <= 6.0.4) allows authenticated administrative users to overwrite system configurations and achieve Remote Code Execution (RCE) with root privileges. The application fails to sanitize the username JSON parameter before injecting it into a systemd service override file (override.conf) via fmt.Sprintf. By injecting a newline character (\n), an attacker can break out of the intended Environment variable definition block and introduce arbitrary systemd directives (e.g., ExecStartPre), which will be executed with root privileges upon service restart. The issue is patched in version 6.1.0. |
|---|
| स्रोत | ⚠️ https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv |
|---|
| उपयोगकर्ता | wanyan (UID 95221) |
|---|
| सबमिशन | 21/08/2026 03:43 AM (28 दिन पहले) |
|---|
| संयम | 17/09/2026 07:45 AM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 406309 [rcourtman Pulse तक 6.0.4/6.1.0-rc.4 Quick Security Setup quick-setup fmt.Sprintf उपयोगकर्ता नाम अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|