An OS command injection vulnerability in Prowler versions prior to 5.36.0 allows authenticated users to execute arbitrary commands, creating a severe risk of system compromise.

The vulnerability exists in the Kubernetes provider connection test, where attacker-supplied kubeconfig content containing legacy authentication providers is processed through a subprocess call without adequate neutralization. This requires authenticated access to the API to trigger the injection.

Successful exploitation allows an authenticated user to achieve command execution on the system running the Prowler worker, which could lead to full control of the underlying infrastructure. With a CVSS score of 9.9, the impact on the security of the cloud environment managed by Prowler is catastrophic, as it allows attackers to escalate privileges and move laterally within the cloud management plane.

Immediate Action: Update Prowler to version 5.36.0 or later to patch the command injection flaw in the Kubernetes provider connection logic.

Proactive Monitoring: Monitor API access logs for anomalous requests to the connection test endpoints and audit shell execution logs for unexpected processes spawned by the Prowler service.

Compensating Controls: Restrict access to the Prowler API to only authorized and trusted personnel to minimize the risk of exploitation by malicious insiders or compromised user accounts.

Public Exploit Available: Unknown.

Immediate update to version 5.36.0 is required for all Prowler deployments. Because this vulnerability allows for OS command injection, it represents a significant threat to the security of the infrastructure being managed by the Prowler platform, and the patch should be applied without delay.