A critical code injection vulnerability in Horilla HR software allows an authenticated attacker to execute arbitrary OS commands with elevated privileges.

The application improperly handles the columns POST parameter in the HorillaListView.export_data function by interpolating user input into Python source code passed to exec(). This allows an authenticated user to inject malicious Python syntax, leading to remote code execution with the privileges of the application process, which may include root access in containerized environments.

The ability to execute arbitrary OS commands represents a total compromise of the application server. Given the CVSS score of 8.8, this vulnerability poses a severe risk of data exfiltration, unauthorized administrative access, and potential lateral movement within the network. If the software is running in a default Docker configuration, the attacker may gain full root-level control over the host container.

Immediate Action: Upgrade to Horilla version 2.0.0 or later immediately to incorporate the necessary security fixes for the export_data function.

Proactive Monitoring: Monitor server logs for suspicious POST requests to the export_data endpoint and inspect system process logs for unauthorized execution of shell commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize POST parameters, specifically looking for attempts to inject Python syntax or control characters into the columns field.

Public Exploit Available: No

This vulnerability presents a significant risk to organizational infrastructure due to the potential for full system compromise. Security teams must prioritize upgrading to version 2.0.0 across all instances. Failure to patch allows any authenticated user to potentially gain complete control over the application environment.