Arbitrary Command Execution in Google Turbinia

Executive Summary

This vulnerability in Google Turbinia allows arbitrary command execution through worker tasks. Attackers with privileges to submit processing requests or influence evidence paths can inject malicious commands into shell executions. The issue stems from evidence paths being directly interpolated into shell commands with shell=True, enabling command injection via shell metacharacters in paths.

Useful 0 Not Useful 0

Detection Guidance

Check Turbinia worker logs for evidence paths containing shell metacharacters like semicolons, pipes, or command substitutions. Inspect commands executed by workers for shell=True usage with interpolated paths. Review evidence submission requests for suspicious path formats.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain remote code execution on Turbinia workers, which often run with high privileges. This could lead to full system compromise, allowing access to sensitive data, credentials, or further lateral movement within the forensic analysis environment. The impact depends on worker permissions but may include data theft, system takeover, or disruption of forensic operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data processed by Turbinia, violating confidentiality requirements in GDPR and HIPAA. Organizations using Turbinia for forensic analysis may face compliance violations if attackers access protected health information or personal data during exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Update Turbinia to the fixed version released on 2026-07-10. Ensure all worker commands use shell=False and pass arguments as lists. Validate and sanitize evidence paths before processing to prevent command injection.

Useful 0 Not Useful 0