`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration

Root Cause: The vulnerability stems from the lack of input validation on the hostname parameter when creating or editing environments in osctrl-admin. The hostname is directly incorporated into enrollment one-liner scripts using Go's text/template package, which does not perform shell escaping. This allows an authenticated administrator to inject arbitrary OS commands by crafting a malicious hostname [1][2].

Exploitation: An attacker with administrative access to osctrl can create or modify an environment with a specially crafted hostname. When endpoints enroll using the compromised environment, the injected commands are embedded into the enrollment script and execute on each endpoint. The commands run before osquery is installed, at the root/SYSTEM privilege level, and thus leave no agent-level audit trail [2]. This makes detection difficult.

Impact: Successful exploitation results in remote code execution on every endpoint that enrolls from the affected environment. An attacker can install backdoors, exfiltrate credentials, and achieve full compromise of the enrolling systems [2]. The wide reach of this vulnerability makes it particularly severe.

Mitigation: The issue is fixed in osctrl version 0.5.0. Pull requests #777 and #780 introduced input validation filters for environment fields, including hostname [1][4]. As a workaround, administrators should restrict access to trusted personnel, review existing environment configurations for suspicious hostnames, and monitor enrollment scripts for unexpected commands [2].