This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) within the set_hostname_internal function of NooBaa's cluster_internal_api, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. The hostname parameter is directly passed to a shell command without sanitization, allowing an authenticated attacker with administrative privileges to inject shell metacharacters and execute arbitrary OS commands with the privileges of the NooBaa process. Red Hat has assigned a CVSS v3.1 score of 7.2 (High) reflecting network attack vector, low complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is confirmed and published by Red Hat, but no patch or mitigation that meets Red Hat's standards is currently available.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary operating system commands on the host system with the privileges of the NooBaa process. This can lead to unauthorized code execution, data modification or disclosure, and denial of service. The attack requires administrative access, limiting the attack surface, but the impact on confidentiality, integrity, and availability is high if exploited.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires administrative privileges, restricting administrative access and following best practices for privilege management may reduce risk. Customers with Red Hat Technical Account Managers can consult them for guidance. No other specific mitigations are provided by Red Hat at this time.