OS Command Injection in Komodo 2.2.0

Executive Summary

This vulnerability is an OS command injection flaw in Komodo version 2.2.0. It exists in the periphery agent's container-management functionality. An authenticated low-privileged user with Execute or Read plus Logs permission can inject shell metacharacters into a container name. When DestroyContainer or SearchContainerLog operations process this name, the input is executed via sh -c without proper escaping, allowing arbitrary root-level commands on the managed host.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized container operations or unexpected shell commands in logs. Inspect container names for shell metacharacters like semicolons or backticks. Review Komodo agent logs for suspicious DestroyContainer or SearchContainerLog operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited access to gain full root-level control over the managed host. They can execute any command, install malware, steal data, or pivot to other systems. Even users without Terminal permission can exploit this to compromise the entire server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR, HIPAA, and other standards due to unauthorized root access enabling data breaches, lack of access controls, and inability to maintain system integrity. Organizations using Komodo 2.2.0 would fail audits and face regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Komodo to a patched version if available.
• Restrict Execute, Read, and Logs permissions to trusted users only.
• Monitor for unusual container activity or command execution.
• Apply principle of least privilege to Komodo user permissions.

Useful 0 Not Useful 0