Summary
Fledge's backup-restore upload handler constructs a shell command from an archive member filename without safely quoting it. An authenticated administrator who can upload a crafted backup archive may cause arbitrary operating-system commands to run with the service's privileges.
Affected context
The issue occurs in Fledge deployments that use the backup-restore upload functionality and process uploaded tar archives. Risk increases when an administrator or another user with equivalent upload permissions can submit an archive whose first member filename passes the handler's basic backup-name and extension checks, while still being interpreted by a shell.
Exploit preconditions
- Attack surface: Backup-restore archive upload handling
- Required access: Authenticated administrative access, or another permission set that allows backup uploads
- Trigger point: Processing the first extracted tar member and copying it to the backup destination
- Why exploitation is possible: The member filename is inserted into a command string and executed through
os.system()without shell-safe quoting or argument separation
Why this happens
The handler treats a user-controlled archive member filename as data while embedding it directly into a shell command. Prefix and suffix validation checks naming conventions but do not establish that the value is safe for shell interpretation. Because os.system() invokes a shell and the command is assembled through string formatting, shell metacharacters and substitutions may alter command behavior. This is CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The Fledge service account could be compromised
- Backup data or application files could be modified, deleted, or exfiltrated
- The host environment may be used for further lateral movement
- Service availability and data integrity could be disrupted
General mitigation guidance
Mitigation generally centers on removing shell interpretation from file-copy operations and reducing trust in archive metadata.
Common defensive patterns include:
- Use argument-list process APIs or dedicated file-copy functions instead of shell command strings
- Apply context-appropriate validation to archive member names and destination paths
- Treat archive metadata as untrusted input even when extensions and prefixes appear valid
- Restrict archive extraction to expected directories and prevent path traversal
- Run backup-restore operations with the minimum filesystem and operating-system privileges required
- Enforce authorization, audit logging, and controlled access for backup uploads
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules identifying
os.system()or shell-spawning APIs fed by archive metadata, filenames, or request parameters - Code review checks for string formatting or concatenation used to construct operating-system commands
- Review signals showing missing argument separation, shell quoting, or dedicated filesystem APIs
- Tests that submit filenames containing shell-sensitive characters and verify they remain inert
- Runtime monitoring for unexpected child processes launched by the Fledge service
- Policy enforcement that prohibits shell command construction from untrusted input
