SecBoard
Zurück zur CVE-Übersicht

CVE-2026-100844

HIGH(8.4)

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score31/100 — MITTEL
  • CVSS 8.4 — Hoch
  • Weniger als 24 Stunden alt

Beschreibung

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on Linux, '&' on Windows) are interpreted. If a victim loads and processes a crafted configuration file — for example by instantiating nnUNetV2Runner with the malicious YAML and invoking a training/validation job such as train_single_model() — arbitrary commands are executed with the privileges of the user running the job.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 1.6.0

Threat-Hunting-Queries

Detects OS command injection attempts by monitoring process creation with shell metacharacters in arguments, specifically targeting the 'dataset_name_or_id' parameter in MONAI's nnUNetV2Runner component.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "nnunetv2_runner" and InitiatingProcessCommandLine contains "dataset_name_or_id"
| where ProcessCommandLine matches regex @'(;|\&|\|)'

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 (New_Process_Name=*nnunetv2_runner* OR CommandLine=*nnunetv2_runner*) (CommandLine=*dataset_name_or_id*) (CommandLine~"[;&|]")

Sigma

title: MONAI nnUNetV2Runner OS Command Injection Attempt
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: 'nnunetv2_runner.exe'
    CommandLine|contains: 'dataset_name_or_id'
    CommandLine|contains:
      - ';'
      - '&'
      - '|'
  condition: selection
falsepositives:
  - Legitimate use of shell metacharacters in specific, controlled environments (unlikely for this specific parameter)
level: high

Elastic ES|QL

from process where process.parent.executable : "*nnunetv2_runner*" and process.args : "*dataset_name_or_id*" and (process.args : "*;*" or process.args : "*&*" or process.args : "*|*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen