A vulnerability in the openshift-metal3 fakefish component allows for OS command injection, posing a significant risk of unauthorized system interaction.

This vulnerability is caused by the improper neutralization of special elements used in OS commands, specifically due to unquoted shell variable injection. An authenticated attacker with low privileges can exploit this to perform unauthorized command execution.

Successful exploitation allows an attacker to execute arbitrary commands, which could lead to unauthorized system access or configuration changes. With a CVSS score of 7.7, this flaw represents a high risk to the integrity of the affected infrastructure, potentially allowing lateral movement or further compromise of the environment.

Immediate Action: Update the affected openshift-metal3 fakefish installation to the version containing the fix, identified as being fixed from commit 526550a onwards.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected shell commands initiated by the fakefish service.

Compensating Controls: Ensure that the service is running with the principle of least privilege to limit the potential impact of an successful command injection.

Public Exploit Available: No (exploit_available false).

Given the high CVSS score and the nature of command injection vulnerabilities, it is imperative to prioritize patching this component. Administrators should verify their current version and upgrade to the patched commit immediately to prevent exploitation.