CVE-2021-32756 Arbitrary eval through MiqExpression
A low-privilege user can execute arbitrary code with root privileges via crafted Ruby strings in the MiqExpression module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32756?
CVE-2021-32756 is a high-severity code injection vulnerability in manageiq, published on 21 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
Which versions are affected by CVE-2021-32756?
It affects 1 product.
Products include Manageiq Manageiq.
How do I fix CVE-2021-32756?
No fix has been published for CVE-2021-32756 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-32756 being exploited?
There is no known exploitation of CVE-2021-32756 in the wild and no public exploit code.
Sources
Also known as GHSA-32x4-vj4r-57rq.