CVE-2022-36633

Vulnerability

CVE-2022-36633 is a command injection vulnerability in Teleport 9.3.6, specifically in the web endpoint that generates node join scripts. The token parameter is not properly sanitized, allowing an attacker to inject arbitrary bash commands using URL-encoded carriage return line feed (CRLF) characters [1][3].

Exploitation

An attacker can craft a malicious SSH agent installation link by replacing the legitimate token with a URL-encoded payload. This link is then sent to a target user via social engineering. When the victim clicks the link, the Teleport server processes the request and generates a script containing the injected commands, which are then executed on the server [3][4]. No authentication is required, and the attack leverages the trusted Teleport server to deliver the payload.

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the Teleport server. This could lead to full compromise of the infrastructure managed by Teleport, including servers, databases, and Kubernetes clusters [3].

Mitigation

The vulnerability is patched in later versions of Teleport. The fix validates that the token exists and is valid in the backend, and also removes the user-controlled node-labels parameter that was also exploitable [1][4]. Users should update to a patched version immediately.