CVE ID

CVE-2024-30680

Title

Shell Injection Vulnerability in ROS2 Iron Irwini

Vulnerability Type

Bash Shell Injection

Severity

TBD

Vendor

The Open Source Robotics Foundation (OSRF)

Products Affected

ROS2 Iron Irwini (ROS_VERSION=2 and ROS_PYTHON_VERSION=3)

Description

A shell injection vulnerability was discovered in ROS2 (Robot Operating System 2) Iron Irwini. The vulnerability exists due to the way ROS2 handles shell command execution in components like command interpreters or interfaces that process external inputs. This flaw allows for remote code execution (RCE) and can be exploited through various attack vectors, potentially leading to remote code execution, escalating privileges, and causing a range of detrimental effects.

Impact

Escalation of Privileges: True; Information Disclosure: True; Other: This vulnerability could lead to unauthorized system access and control, operational disruption, the spread of malware, and damage to trust and reputation.

Attack Vector

The vulnerability can be exploited through malicious file downloads, exploiting input validation flaws, phishing or social engineering, and compromised network traffic.

Solution

Users are advised to update to the latest version of ROS2 Iron Irwini where the vulnerability has been addressed. Ensure that all components and dependencies are also updated to secure versions.

Workaround

If immediate updating is not possible, it is recommended to implement strict input validation, enhance monitoring of network traffic, and educate users about the risks of phishing and malicious downloads.

CVE Status

Confirmed and published.

Credit

Yash Patel and Dr. Parag Rughani

References

N/A