Executive brief
UAC (Unix-like Artifacts Collector) is a forensic analysis tool that collects system artifacts from Unix-like systems. Versions before 3.3.0 contain a command injection flaw where attacker-controlled usernames and home directory paths from /etc/passwd are substituted into shell commands without proper escaping, allowing an attacker to inject arbitrary shell commands and compromise the analyst's host system.
Technical details
A command injection vulnerability exists in parse_artifact.sh where user substitution placeholders (%user%, %user_home%, and %line%) derived from /etc/passwd entries are directly interpolated into shell commands before evaluation via eval without proper escaping. An attacker who can modify /etc/passwd (or who controls a system with predictable entries) can inject shell metacharacters or command substitution syntax (e.g., $(command) or ;command;) through crafted usernames or home directory paths. When an analyst runs UAC on a system with malicious passwd entries, arbitrary commands execute with the analyst's privileges. The vulnerability was patched in version 3.3.0 by properly escaping these placeholders according to shell context before they flow into eval.
Affected products
- tclahr UAC prior to 3.3.0
Timeline
- 2026-08-21: disclosed
- 2026-03-28: patched: Patch merged in commit 2cc367d; fix escapes runtime placeholders before eval