Summary
A command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package.
Impact
When a software package is uploaded to Fleet, metadata such as package identifiers and product names is extracted from the binary and interpolated into auto-generated uninstall shell scripts without sanitization. An attacker who can convince a Fleet administrator to upload a crafted package (for example, through a supply-chain attack, typosquatted download, or compromised software mirror) can embed a malicious payload in the package metadata that executes when the uninstall script runs on managed endpoints.
The attacker does not need Fleet credentials. The Fleet administrator uploading the package is the target, not the threat actor.
Workarounds
Administrators should only upload software packages obtained from trusted, verified sources. Review package metadata (not just install/uninstall scripts) before uploading. If an immediate upgrade is not possible, manually inspect and edit auto-generated uninstall scripts before deployment.
For more information
If you have any questions or comments about this advisory:
Email us at security@fleetdm.com
Join #fleet in osquery Slack
Credits
We thank @secfox-ai for responsibly reporting this issue.
prateek-0490 Reporter
Summary
A command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package.
Impact
When a software package is uploaded to Fleet, metadata such as package identifiers and product names is extracted from the binary and interpolated into auto-generated uninstall shell scripts without sanitization. An attacker who can convince a Fleet administrator to upload a crafted package (for example, through a supply-chain attack, typosquatted download, or compromised software mirror) can embed a malicious payload in the package metadata that executes when the uninstall script runs on managed endpoints.
The attacker does not need Fleet credentials. The Fleet administrator uploading the package is the target, not the threat actor.
Workarounds
Administrators should only upload software packages obtained from trusted, verified sources. Review package metadata (not just install/uninstall scripts) before uploading. If an immediate upgrade is not possible, manually inspect and edit auto-generated uninstall scripts before deployment.
For more information
If you have any questions or comments about this advisory:
Email us at security@fleetdm.com
Join #fleet in osquery Slack
Credits
We thank @secfox-ai for responsibly reporting this issue.