CVE ID

CVE-2024-30726

Title

Shell Injection Vulnerability in ROS Kinetic Kame

Vulnerability Type

Bash Shell Injection

Severity

TBD

Vendor

The Open Source Robotics Foundation (OSRF)

Products Affected

ROS Kinetic Kame (ROS_VERSION=1 and ROS_PYTHON_VERSION=3)

Description

A shell injection vulnerability was discovered in ROS (Robot Operating System) Kinetic Kame. The vulnerability exists due to the way ROS handles shell command execution in components like command interpreters or interfaces that process external inputs. This flaw allows for remote code execution (RCE) and can be exploited through various attack vectors, potentially leading to remote code execution, escalating privileges, and causing a range of detrimental effects.

Impact

Escalation of Privileges: True; Information Disclosure: True; Other: This vulnerability could lead to unauthorized system access and control, operational disruption, the spread of malware, and damage to trust and reputation.

Attack Vector

The vulnerability can be exploited through malicious file downloads, exploiting input validation flaws, phishing or social engineering, and compromised network traffic.

Solution

Users are advised to update to the latest version of ROS Kinetic Kame where the vulnerability has been addressed. Ensure that all components and dependencies are also updated to secure versions.

Workaround

If immediate updating is not possible, it is recommended to implement strict input validation, enhance monitoring of network traffic, and educate users about the risks of phishing and malicious downloads.

CVE Status

Confirmed and published.

Credit

Yash Patel and Dr. Parag Rughani

References

N/A