Improper Neutralization of Special Elements used in a Command ('Command Injection') Affecting consoleme package, versions [,1.4.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-CONSOLEME-6861598
- published 17 May 2024
- disclosed 16 May 2024
- credit Jay Dhulia
Introduced: 16 May 2024
CVE-2024-5023 Open this link in a new tabHow to fix?
Upgrade consoleme to version 1.4.0 or higher.
Overview
consoleme is an A central control plane for AWS permissions and access
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') via the command process. A specific flag allows authenticated users to read any server files accessible by the ConsoleMe process. Given ConsoleMe's role as an AWS identity broker, accessing files containing secrets on the server could potentially be exploited for privilege escalation.
Note:
Deployments of ConsoleMe that allow templated resources are impacted and urged to patch immediately. Deployments that do not permit templated resources are not affected.