Summary
A high-severity OS command injection vulnerability in Rundeck allows authenticated users with permission to run jobs to execute unintended commands on Windows nodes. The issue becomes risky when crafted free-text job options are passed through ineffective argument quoting and interpreted by the Windows command shell.
A high-severity OS command injection vulnerability in Rundeck allows authenticated users with permission to run jobs to execute unintended commands on Windows nodes. The issue becomes risky when crafted free-text job options are passed through ineffective argument quoting and interpreted by the Windows command shell.
Affected context
The vulnerability affects Rundeck deployments before version 6.2.0 when:
- Jobs run on Windows nodes
- Authenticated users can execute jobs
- Job options accept user-controlled free-text values
- Those values are incorporated into commands executed by the node executor
The risk depends on the permissions of the Rundeck job runner and the credentials available on the target node.
The vulnerability affects Rundeck deployments before version 6.2.0 when:
- Jobs run on Windows nodes
- Authenticated users can execute jobs
- Job options accept user-controlled free-text values
- Those values are incorporated into commands executed by the node executor
The risk depends on the permissions of the Rundeck job runner and the credentials available on the target node.
Exploit preconditions
- Attack surface: Rundeck job execution targeting Windows nodes
- Required access: An authenticated account with permission to run the affected job
- Trigger point: Processing a crafted value supplied through a free-text job option
- Why exploitation is possible: Windows command metacharacters can escape ineffective single-quote handling and be interpreted by
cmd.exe - Privilege context: Injected commands execute with the node executor's credentials
- Attack surface: Rundeck job execution targeting Windows nodes
- Required access: An authenticated account with permission to run the affected job
- Trigger point: Processing a crafted value supplied through a free-text job option
- Why exploitation is possible: Windows command metacharacters can escape ineffective single-quote handling and be interpreted by
cmd.exe - Privilege context: Injected commands execute with the node executor's credentials
Why this happens
The underlying flaw is improper neutralization of special elements used in an operating system command. User-controlled option values are passed into Windows command execution, while CLIUtils.quoteWindowsCMDArg uses quoting that does not reliably prevent cmd.exe metacharacter interpretation.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The insecure pattern occurs when application data is combined with shell commands without using an execution model that separates arguments from command syntax.
The underlying flaw is improper neutralization of special elements used in an operating system command. User-controlled option values are passed into Windows command execution, while CLIUtils.quoteWindowsCMDArg uses quoting that does not reliably prevent cmd.exe metacharacter interpretation.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The insecure pattern occurs when application data is combined with shell commands without using an execution model that separates arguments from command syntax.
Potential impact
- An attacker may execute arbitrary commands on Windows nodes
- Commands could run with the node executor's privileges
- Sensitive files, credentials, or environment data could be accessed
- Job results and managed workloads could be modified or disrupted
- Compromised nodes could be used for lateral movement or persistence
- An attacker may execute arbitrary commands on Windows nodes
- Commands could run with the node executor's privileges
- Sensitive files, credentials, or environment data could be accessed
- Job results and managed workloads could be modified or disrupted
- Compromised nodes could be used for lateral movement or persistence
General mitigation guidance
Mitigation generally focuses on preventing user-controlled values from becoming shell syntax.
Common defensive patterns include:
- Prefer direct process execution APIs that pass arguments separately instead of invoking a shell
- Apply strict allowlists and typed schemas for job options rather than accepting unrestricted free text
- Use Windows-specific argument handling that correctly accounts for
cmd.exeparsing rules - Reduce trust in job options by validating and normalizing values before command construction
- Run node executors with the least privileges required for their jobs
- Restrict which users and projects can run jobs on sensitive Windows nodes
- Avoid placing secrets or broad administrative credentials in node execution contexts
Mitigation generally focuses on preventing user-controlled values from becoming shell syntax.
Common defensive patterns include:
- Prefer direct process execution APIs that pass arguments separately instead of invoking a shell
- Apply strict allowlists and typed schemas for job options rather than accepting unrestricted free text
- Use Windows-specific argument handling that correctly accounts for
cmd.exeparsing rules - Reduce trust in job options by validating and normalizing values before command construction
- Run node executors with the least privileges required for their jobs
- Restrict which users and projects can run jobs on sensitive Windows nodes
- Avoid placing secrets or broad administrative credentials in node execution contexts
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules that identify shell invocation combined with user-controlled values
- Code review checks for string concatenation or interpolation in Windows command construction
- Tests covering command metacharacters and platform-specific quoting behavior
- Policy enforcement requiring direct process APIs and typed option definitions
- Runtime monitoring for unexpected child processes, command interpreters, or unusual job activity on Windows nodes
- Audit review of job permissions, option definitions, and executor credentials
Automated code review and security scanning tools may help identify command construction paths, but platform-specific validation remains important.
Organizations can look for this weakness through:
- Static analysis rules that identify shell invocation combined with user-controlled values
- Code review checks for string concatenation or interpolation in Windows command construction
- Tests covering command metacharacters and platform-specific quoting behavior
- Policy enforcement requiring direct process APIs and typed option definitions
- Runtime monitoring for unexpected child processes, command interpreters, or unusual job activity on Windows nodes
- Audit review of job permissions, option definitions, and executor credentials
Automated code review and security scanning tools may help identify command construction paths, but platform-specific validation remains important.
