CVE-2024-9042 is a command injection vulnerability in Kubernetes Windows nodes used by Red Hat OpenShift for Windows Containers. It allows an attacker with the ability to query the '/logs' endpoint on a Windows worker node to execute arbitrary OS commands on the host. This vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-770. The vulnerability affects Windows worker nodes running versions of the OpenShift Windows Machine Config Operator prior to 10.17.1. Red Hat has released OpenShift for Windows Containers 10.17.1 as a product release that addresses this issue. However, a direct patch for the underlying vulnerability is not yet available or does not meet Red Hat's criteria for deployment. Users should upgrade to version 10.17.1 and review audit logs for suspicious node 'logs' queries. The vulnerability has a Red Hat CVSS v3 base score of 5.9 (Important), with high confidentiality and integrity impact but no availability impact. No known exploits are reported in the wild.

An attacker with permission to query the '/logs' endpoint on a Windows worker node can execute arbitrary commands on the host OS. This can lead to unauthorized code execution, data reading or modification, and potentially disabling the product or hiding malicious activity. The impact affects confidentiality and integrity but does not affect availability. Since the commands execute as the application or its owner, malicious actions may be disguised as legitimate activity. The vulnerability is limited to Windows worker nodes in the OpenShift environment and does not affect other platforms.

Red Hat has released OpenShift for Windows Containers version 10.17.1, which includes fixes addressing this vulnerability. Users should upgrade to this version to mitigate the risk. Currently, no other mitigation options meet Red Hat's criteria for ease of use and broad applicability. Users should also monitor cluster audit logs for suspicious queries to the node '/logs' endpoint as a detection measure. No direct patch for the underlying vulnerability is available outside of upgrading to the fixed product release.