A critical deserialization vulnerability in openITCOCKPIT versions below 5.4.0 could allow an authenticated attacker to achieve remote code execution.

The application utilizes an unsafe deserialization sink within the oitc_gearman worker function, which processes job payloads using PHP's unserialize() without validation. An authenticated attacker who can interact with the Gearman service can inject malicious objects to trigger remote code execution.

Successful exploitation of this vulnerability can lead to full system compromise, as the deserialization flaw allows for arbitrary code execution within the context of the Gearman worker. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to the integrity and availability of the monitoring infrastructure, potentially exposing sensitive environment data or facilitating lateral movement within the network.

Immediate Action: Upgrade to openITCOCKPIT version 5.4.0 or later immediately to incorporate the necessary input validation and fix the unsafe deserialization sink.

Proactive Monitoring: Review Gearman service logs for unexpected job submissions and monitor system processes for anomalous activity originating from the Gearman worker.

Compensating Controls: Restrict network access to the Gearman service (TCP/4730) to authorized, trusted internal hosts only, ensuring that the service is not exposed to untrusted segments of the network.

Public Exploit Available: Unknown

Organizations utilizing openITCOCKPIT must prioritize the update to version 5.4.0 as the primary method of remediation. Given that the vulnerability resides in the core worker logic, patching is the only effective way to eliminate the risk of object injection. Administrators should also verify that their Gearman service is properly firewalled to prevent unauthorized access while the upgrade process is underway.