Thales CERT Suspicious Application Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Thales CERT 'Suspicious' application, versions through 1.3.4. This vulnerability allows an unauthenticated attacker to execute arbitrary code and overwrite writable application files, including Python modules, configuration files, cron inputs, and runtime artifacts. The issue leads to a persistent denial of service, potential compromise of application secrets or integrations, and root-level execution within the Django application container.

Impact

Exploitation of this vulnerability allows for remote code execution inside the Django application container, with the executed code running as root. It also enables arbitrary overwriting of writable application files, which can disrupt normal application operation and lead to a persistent denial of service. Additionally, if the overwritten files influence application configuration or code execution paths, there is a risk of compromising application secrets or integrations.

Remediation

Users are advised to upgrade to Thales CERT 'Suspicious' application version 1.3.5.