OpenOps Remote Code Execution Vulnerability in Terraform Block

A remote code execution vulnerability has been identified in OpenOps versions prior to 0.6.11. This issue arises within the Terraform block, where user inputs are not properly validated, allowing for the execution of unsafe code.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where OpenOps is running.

Reproduction

The vulnerability can be reproduced by uploading a Terraform file that includes a malicious command. This can be done through the OpenOps interface that accepts Terraform files. Once the file is uploaded, the malicious command will be executed on the server.

Remediation

Users can update to OpenOps version 0.6.11 or later, where this vulnerability has been fixed.