Puppet RCE vulnerabilities allow server compromise
Original title: Pulling the right strings for RCE on a Puppet
Two critical RCE flaws in Puppet 6.24.0 and 8.20.0 were found and fixed.
A red team discovered two CVSS 9+ RCE vulnerabilities in Puppet Enterprise and open-source versions dating to 2021. They reside in data ingestion and deserialization paths, allowing unauthenticated remote code execution on the management server. The issues were responsibly disclosed and patched in newer releases.
Unconfirmed: No public exploitation reported.
- Affects Puppet 6.24.0 and 8.20.0
- Exploited via report endpoint
- Fixed in patched versions
Impact: Remote code execution on Puppet server
- 1.Upgrade to patched Puppet version
- 2.Isolate Puppet server
From the original article
10 min read at neodyme.io
In preparation for a red team engagement we found two critical CVSS 9+ vulnerabilities in Puppet, dating back to 2021. They allow RCE on the puppet management server in a default configuration. Additionally, we discovered a Puppet host impersonation vulnerability in a non-default but commonly used configuration.
By neodyme.io via buherator · neodyme.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.