fluid-cloudnative fluid up to 0.9.2 os command injection

Summaryinfo

A vulnerability classified as critical was found in fluid-cloudnative fluid up to 0.9.2. This affects an unknown part. Executing a manipulation can lead to os command injection. The identification of this vulnerability is CVE-2023-51699. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in fluid-cloudnative fluid up to 0.9.2. It has been declared as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2023-51699 since 12/21/2023. The exploitation appears to be difficult. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 0.9.3 eliminates this vulnerability. Applying the patch e0184cff8790ad000c3e8943392c7f544fad7d66 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Cloud Software

Vendor

• fluid-cloudnative

Name

• fluid

Version

• 0.9.0
• 0.9.1
• 0.9.2

License

• open-source

Website

• Product: https://github.com/fluid-cloudnative/fluid/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion