VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Komodo Periphery, an agent within the Komodo server management platform, improperly validates user-supplied Docker container names before incorporating them into shell commands. Specifically, the DestroyContainer/RemoveContainer and SearchContainerLog/GetContainerLogSearch operations interpolate raw container names into 'sh -c' command lines without shell escaping or validation. These commands execute with root privileges on the host OS and Docker socket. An authenticated user with Logs or Execute permissions can exploit this to perform OS command injection, leading to arbitrary root command execution and persistent infrastructure compromise. The vulnerability affects all versions prior to 2.3.0. The issue was patched in version 2.3.0 by implementing shell escaping, replacing heredocs with pipes, and adding argument injection protections.

An authenticated non-admin user with specific permissions can escalate privileges via OS command injection, executing arbitrary commands as root on the host server. This compromises the Komodo deployment's infrastructure, enabling persistent access, lateral movement, and full control over managed resources. The vulnerability bypasses Komodo's permission model and affects all installations with multiple users where non-admins have restricted permissions. Exploitation requires an account with Logs or Execute grants; unauthenticated attackers or admin-only installations are not affected.

A patch addressing this vulnerability is available in Komodo Periphery version 2.3.0 and later. Users should upgrade immediately to these versions to remediate the issue. No effective workarounds exist. Auditing and limiting who holds Logs or Execute permissions can reduce exposure but does not eliminate the risk. The vendor recommends updating to version 2.3.0 as the definitive fix.