Automai BotManager Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in Automai BotManager version 25.2.0. This issue arises from improper certificate validation, allowing remote attackers to execute arbitrary system commands via the BotManager.exe component. The injected commands are executed with the application's privileges, potentially leading to unauthorized access, data manipulation, installation of malware, and a full compromise of the underlying system and connected infrastructure.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the operating system, which could be used to gain unauthorized access, manipulate or exfiltrate data, install malware, and possibly compromise the entire system and its connected infrastructure.