An authenticated OS command injection vulnerability in jmpsec osctrl allows malicious administrators to achieve remote code execution on all endpoints enrolled in a compromised environment.

This vulnerability is an OS command injection flaw (CWE-78) occurring in the osctrl-admin environment configuration. An authenticated administrator can inject malicious shell commands into the hostname parameter, which are then improperly processed by Go template functions, leading to execution on downstream endpoints during the enrollment process.

The ability for a compromised or malicious administrator account to execute arbitrary commands on all managed endpoints represents a catastrophic security failure. Successful exploitation results in full system compromise, as commands execute with root or SYSTEM privileges before the osquery agent is fully installed, effectively bypassing agent-based security controls. Given the CVSS score of 7.3, this flaw poses a significant risk to organizational integrity, potentially facilitating widespread credential theft, backdoor deployment, and total loss of endpoint confidentiality and availability.

Immediate Action: Upgrade jmpsec osctrl to version 0.5.0 or later immediately to incorporate the necessary shell escaping fixes.

Proactive Monitoring: Review existing environment configurations for anomalous hostname entries and monitor enrollment scripts for unexpected shell commands or encoded payloads.

Compensating Controls: Restrict access to the osctrl administrative interface to a strictly limited set of trusted personnel and implement robust audit logging for all administrative actions taken within the management console.

Public Exploit Available: Unknown

The severity of this command injection vulnerability, combined with its ability to bypass endpoint security by executing code during the enrollment phase, necessitates immediate attention. Administrators must prioritize updating to version 0.5.0 to eliminate the injection vector. Until the update is applied, ensure that administrative access to the osctrl platform is strictly controlled and audited to prevent unauthorized environment modifications.