OS Command Injection in reNgine via Custom Headers

Executive Summary

This is an OS Command Injection vulnerability in reNgine versions up to v2.2.0 and the master branch. It occurs in the custom_headers scan engine configuration field in web/reNgine/tasks.py, specifically in the fetch_url and dir_file_fuzz functions. The issue arises because custom headers are processed into shell commands without proper sanitization, allowing attackers to inject arbitrary OS commands as root within the celery worker container.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the reNgine installation for versions up to v2.2.0 or the master branch commit de4199222cca5618f1255930ce78987e47d43a99. Check the custom_headers field in web/reNgine/tasks.py, particularly in fetch_url and dir_file_fuzz functions for improper shell command handling.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the system running reNgine with root privileges. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Since reNgine is used for security assessments, attackers might leverage this to pivot into other systems or escalate privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Organizations using reNgine may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update reNgine to a patched version beyond v2.2.0 or the specified commit. Remove or sanitize custom_headers input in scan engine configurations. Restrict celery worker container permissions to prevent root command execution.

Useful 0 Not Useful 0