Threats tagged 'ghsa-wqp3-6ff6-46w7'

In Eclipse Kura versions up to 5.6.2, the CommandCloudApp.execute() function improperly extracts a ZIP archive supplied by a caller into a directory also specified by the caller. This occurs within the Kura JVM process running as the 'kurad' user with elevated capabilities. A user with 'rest.command' permission, even when restricted to unprivileged command execution, can exploit this to write or overwrite arbitrary files on the device by setting the working directory to root (/), bypassing the intended sandbox restrictions. The command service is disabled by default since Kura 4.0.0, and this vulnerability only applies if the command service is enabled.