Remote Code Execution

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint. The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution. Restricting access to the management network with an external firewall can partially mitigate this risk.

N/A

N/A

Nokia CloudBand Infrastructure Software和Nokia Container Service 安全漏洞

Nokia CloudBand Infrastructure Software和Nokia Container Service都是芬兰诺基亚（Nokia）公司的产品。Nokia CloudBand Infrastructure Software是一款用于支撑网络功能虚拟化的平台。Nokia Container Service是一个容器管理服务。 Nokia CloudBand Infrastructure Software和Nokia Container Service存在安全漏洞，该漏洞源于对HTTP标

N/A

N/A