A critical code injection vulnerability in the Magistrala Rules Engine allows authenticated attackers to execute arbitrary scripts on the server.

This vulnerability (CWE-94) occurs because the Rules Engine allows authenticated users to embed and execute Go or Lua scripts server-side, which can be leveraged to gain unauthorized system control.

An attacker successfully exploiting this vulnerability gains the ability to execute arbitrary code with the privileges of the Magistrala service, potentially resulting in full system compromise. The CVSS score of 8.8 reflects the high impact on system integrity and the potential for lateral movement within an IoT infrastructure.

Immediate Action: Review vendor advisories for available security patches or configuration changes that restrict script execution capabilities within the Rules Engine.

Proactive Monitoring: Audit all user-created rules and monitor server processes for anomalous script execution or unauthorized outbound network traffic originating from the engine.

Compensating Controls: Restrict access to the Rules Engine creation interface to only highly trusted administrators and isolate the Magistrala instance within a segmented network zone.

Public Exploit Available: No (exploit_available: false)

This vulnerability is highly dangerous due to the nature of server-side code execution. Organizations should immediately review their usage of the Magistrala Rules Engine and apply updates as soon as the vendor provides a formal patch.