Northern.tech CFEngine Command Injection Vulnerability

A command injection vulnerability has been identified in Northern.tech CFEngine Enterprise and Community versions prior to 3.21.8, 3.24.3, and 3.27.0. This vulnerability arises from missing input sanitization in the CFEngine policy language, allowing injected shell commands to be executed inappropriately, particularly when custom policies process external data.

Impact

Exploitation of this vulnerability could enable an attacker to inject and execute arbitrary shell commands on the hub, especially through custom policies that manage users or similar resources.

Remediation

Users are advised to upgrade to CFEngine version 3.27.0, 3.24.3, 3.21.8, or later. Instructions for upgrading CFEngine are available in the CFEngine documentation.