SecOps SOAR Server Remote Code Execution Vulnerability for Users with IDE Role

A remote code execution vulnerability has been identified in the SecOps SOAR server, specifically within the custom integrations feature. This issue allows an authenticated user with an 'IDE role' to execute arbitrary code on the server. The vulnerability arises from inadequate validation of uploaded Python package code. An attacker could exploit this by uploading a package that includes a malicious setup.py file, which would be executed on the server during the installation process, potentially leading to a complete compromise of the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server, with the executed code running in the server's environment, potentially leading to a full server compromise.

Remediation

All customers have been automatically upgraded to the fixed version 6.3.64 or higher.