SecBoard
Zurück zur CVE-Übersicht

CVE-2026-106056

HIGH(7.5)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

1.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 6.2.0

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "cmd.exe" and InitiatingProcessCommandLine contains "rundeck" and (CommandLine contains "&&" or CommandLine contains "|")

Splunk SPL

index=* sourcetype=WinEventLog:Security (CommandLine="*&&*" OR CommandLine="*|*") InitiatingProcessCommandLine="*cmd.exe*" InitiatingProcessCommandLine="*rundeck*"

Sigma

title: Rundeck Windows Command Injection
author: SecBoard
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\cmd.exe'
    CommandLine|contains: 
      - '&&'
      - '|'
    ParentCommandLine|contains: 'rundeck'
  condition: selection
level: high

Elastic ES|QL

from process where process.parent.executable : "cmd.exe" and process.command_line : ("*&&*", "*|*") and process.parent.command_line : "*rundeck*"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen