Executive brief
Zowe Imperative is a framework used to build command-line interfaces (CLIs) for IBM Zowe, an open-source integration platform. A local privilege escalation vulnerability allows an already-privileged user to execute arbitrary shell commands through malicious plugin installation commands or environment variables, potentially compromising system integrity and data confidentiality.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the Imperative framework affecting plugin install/update commands. The root cause involves insufficient sanitization of shell commands when executing NPM operations with user-controlled input from plugin installation or environment variables. The attack requires local access and existing elevated privileges (PR requirement noted). An attacker can inject arbitrary shell commands to achieve local code execution. Patches are available in versions 4.18.10 and 5.7.1 or later, with fixes applied in pull requests #900 and #902.
Affected products
- Zowe Imperative CLI All versions before 4.18.10; 5.0.0 through 5.7.0
Timeline
- 2023-03-01: disclosed: GHSA advisory published
- 2023-03-01: patched: Patches available in versions 4.18.10 and 5.7.1