An unauthenticated OS command injection vulnerability in the Nuclio serverless framework allows remote attackers to execute arbitrary code within the dashboard container.

This is an OS command injection vulnerability (CWE-78) occurring because the Nuclio dashboard fails to properly sanitize the resourceNamespace parameter when no specific resource name is provided. An unauthenticated attacker can inject shell metacharacters through specific HTTP headers (X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace) to execute unauthorized commands via the underlying shell.

Successful exploitation allows an attacker to gain arbitrary command execution within the dashboard container, which can lead to complete compromise of the containerized environment. Given the CVSS score of 8.7, this vulnerability poses a high risk to system integrity and data confidentiality, potentially allowing attackers to pivot within the network or deploy malicious payloads within the serverless infrastructure.

Immediate Action: Update the Nuclio serverless framework to version 1.17.4 or later to apply the necessary security patches.

Proactive Monitoring: Monitor dashboard access logs for anomalous HTTP headers containing shell metacharacters or unexpected requests to the list-all resource path.

Compensating Controls: Implement strict network ingress filtering to restrict access to the Nuclio dashboard to authorized IP addresses only, reducing the exposure to unauthenticated external actors.

Public Exploit Available: No

The severity of this vulnerability, combined with the ease of access for unauthenticated attackers, necessitates an immediate update to version 1.17.4. Security teams should prioritize patching this instance to prevent potential container compromise and unauthorized command execution. If immediate patching is not feasible, restrict access to the dashboard via network controls until the update can be deployed.