Summary
FOG contains an OS command injection vulnerability in the Storage Node editing API. An authenticated API-enabled user who has the required API tokens may alter Storage Node fields that are later incorporated into an lftp command, potentially executing commands with root privileges when storage replication is active.
FOG contains an OS command injection vulnerability in the Storage Node editing API. An authenticated API-enabled user who has the required API tokens may alter Storage Node fields that are later incorporated into an lftp command, potentially executing commands with root privileges when storage replication is active.
Affected context
The issue occurs in FOG deployments where:
- An API-enabled user can access the Storage Node edit endpoint
- The user possesses both the user API token and the global FOG API token
- Storage replication is enabled
- A usable Storage Node causes the replication component to construct and execute an
lftpcommand - The FOG service executes that command with elevated privileges
The affected fields include Storage Node user, password, and FTP path values.
The issue occurs in FOG deployments where:
- An API-enabled user can access the Storage Node edit endpoint
- The user possesses both the user API token and the global FOG API token
- Storage replication is enabled
- A usable Storage Node causes the replication component to construct and execute an
lftpcommand - The FOG service executes that command with elevated privileges
The affected fields include Storage Node user, password, and FTP path values.
Exploit preconditions
- Attack surface: Authenticated FOG API, specifically the Storage Node edit operation
- Required access: An API-enabled authenticated user with
uType=1and both required API tokens - Trigger point: Storage replication processing after modified Storage Node fields are saved
- Required environment: A usable Storage Node with replication enabled
- Why exploitation is possible: The API validates credentials but does not enforce an administrator-only authorization decision, and attacker-controlled values are interpolated into an operating-system command executed by a root-running service
- Attack surface: Authenticated FOG API, specifically the Storage Node edit operation
- Required access: An API-enabled authenticated user with
uType=1and both required API tokens - Trigger point: Storage replication processing after modified Storage Node fields are saved
- Required environment: A usable Storage Node with replication enabled
- Why exploitation is possible: The API validates credentials but does not enforce an administrator-only authorization decision, and attacker-controlled values are interpolated into an operating-system command executed by a root-running service
Why this happens
The vulnerability combines insufficient authorization enforcement with OS command construction from attacker-influenced data. The Storage Node API permits a non-administrator user to modify fields that later reach an lftp command without adequate separation between data and command syntax.
This behavior maps primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command. The missing administrator-only role check also maps to CWE-862: Missing Authorization, because credential validation alone does not establish that the caller is permitted to modify privileged Storage Node settings.
The vulnerability combines insufficient authorization enforcement with OS command construction from attacker-influenced data. The Storage Node API permits a non-administrator user to modify fields that later reach an lftp command without adequate separation between data and command syntax.
This behavior maps primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command. The missing administrator-only role check also maps to CWE-862: Missing Authorization, because credential validation alone does not establish that the caller is permitted to modify privileged Storage Node settings.
Potential impact
- An attacker may execute arbitrary commands as the service's root identity.
- The FOG host could be fully compromised.
- Stored credentials and imaging data could be disclosed or altered.
- Images or replication content could be poisoned.
- The compromised host could be used for lateral movement or persistence.
- FOG infrastructure availability could be disrupted.
- An attacker may execute arbitrary commands as the service's root identity.
- The FOG host could be fully compromised.
- Stored credentials and imaging data could be disclosed or altered.
- Images or replication content could be poisoned.
- The compromised host could be used for lateral movement or persistence.
- FOG infrastructure availability could be disrupted.
General mitigation guidance
Mitigation generally focuses on enforcing authorization before accepting privileged configuration changes and eliminating shell interpretation of user-controlled values.
Common defensive patterns include:
- Restricting Storage Node credential and path changes to explicitly authorized administrators
- Applying deny-by-default, server-side authorization checks rather than relying only on API-token validity
- Replacing shell command construction with argument-safe process APIs or dedicated library interfaces
- Validating and allowlisting usernames, paths, and connection parameters according to their intended formats
- Separating credentials from command arguments and avoiding interpolation into shell command strings
- Running replication services with the lowest practical operating-system privileges
- Limiting Storage Node network access and protecting API tokens as sensitive credentials
- Monitoring and controlling changes to replication configuration
Mitigation generally focuses on enforcing authorization before accepting privileged configuration changes and eliminating shell interpretation of user-controlled values.
Common defensive patterns include:
- Restricting Storage Node credential and path changes to explicitly authorized administrators
- Applying deny-by-default, server-side authorization checks rather than relying only on API-token validity
- Replacing shell command construction with argument-safe process APIs or dedicated library interfaces
- Validating and allowlisting usernames, paths, and connection parameters according to their intended formats
- Separating credentials from command arguments and avoiding interpolation into shell command strings
- Running replication services with the lowest practical operating-system privileges
- Limiting Storage Node network access and protecting API tokens as sensitive credentials
- Monitoring and controlling changes to replication configuration
How teams detect issues like this
Detection approaches can include:
- Static analysis rules for
proc_open(), shell execution, and string interpolation involving request or API-derived values - Code review checks for privileged endpoints that validate authentication without verifying role or resource permissions
- Searches for API handlers that write directly to command-consumed configuration fields
- Runtime monitoring of Storage Node edits, replication configuration changes, and root-owned child processes
- Policy enforcement requiring parameterized process execution and centralized authorization middleware
- Alerts for unexpected
lftpactivity, unusual replication destinations, or command execution by the FOG service account
Automated code review and software composition analysis tools may help identify command construction and authorization patterns, but should be supplemented with manual review of privilege boundaries.
Detection approaches can include:
- Static analysis rules for
proc_open(), shell execution, and string interpolation involving request or API-derived values - Code review checks for privileged endpoints that validate authentication without verifying role or resource permissions
- Searches for API handlers that write directly to command-consumed configuration fields
- Runtime monitoring of Storage Node edits, replication configuration changes, and root-owned child processes
- Policy enforcement requiring parameterized process execution and centralized authorization middleware
- Alerts for unexpected
lftpactivity, unusual replication destinations, or command execution by the FOG service account
Automated code review and software composition analysis tools may help identify command construction and authorization patterns, but should be supplemented with manual review of privilege boundaries.
