CyberRota Analysis
AI-GeneratedPuppet Enterprise versions with the java_keystore_passwd parameter are vulnerable to command injection, allowing authenticated users with administrative privileges to execute arbitrary shell commands. This flaw can lead to full system compromise, as the injected commands run with root privileges. Organizations using Puppet Enterprise should prioritize patching this vulnerability to mitigate the risk of unauthorized access and potential system takeover.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.