Description

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-21T18:16:48.103Z",
  "pubdate": "2026-08-21T18:16:48.103Z",
  "executiveSummary": "A command injection vulnerability exists within versions prior to 3.3.0 of UAC (Unix-like Artifacts Collector), specifically residing within the internal _run_command function. This security flaw enables malicious actors to execute arbitrary system commands directly on the forensic analyst's host system when processing untrusted evidence data.\nThe vulnerability type is classified as OS Command Injection, leading to Remote Code Execution (RCE). The impact is severe, as successful exploitation compromises the integrity and confidentiality of the analysis workstation, potentially granting the attacker complete control over the host environment.\nAffected systems include all deployments of UAC (Unix-like Artifacts Collector) running software versions prior to 3.3.0. Risk implications are substantial given that digital forensics and incident response (DFIR) tools inherently ingest untrusted, potentially hostile data from compromised endpoints or external storage media.\nAttacker capabilities include the execution of arbitrary commands with the privileges of the forensic analyst running the UAC utility. Exploitation requirements involve the adversary successfully introducing crafted evidence inputs containing malicious shell metacharacters, supplying mounted forensic images containing hostile filenames, or tampering with internal artifact definitions processed by the collection utility.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure handling of untrusted data within the _run_command function of UAC (Unix-like Artifacts Collector) prior to version 3.3.0. When the utility executes underlying system utilities or shell commands, input parameters derived from external sources are passed improperly to the underlying operating system shell without adequate sanitization, escaping, or the use of safe execution abstractions.\nThe vulnerable component is the _run_command function responsible for executing shell commands throughout the artifact collection process. Affected versions include all releases of UAC (Unix-like Artifacts Collector) prior to version 3.3.0.\nAuthentication and privilege requirements depend entirely on the execution context of the analyst running the tool, but exploitation does not require prior authentication to the tool itself. Network exposure is typically non-existent or minimal, as the attack vector relies heavily on local or file-based ingestion rather than direct network listeners, though ingestion over network shares or remote evidence acquisition mounts is feasible.\nThe attack flow proceeds as follows: First, an attacker prepares malicious payloads embedded within untrusted data vectors, such as specially crafted usernames, anomalous process names, or malicious filenames designed to break out of quoted string arguments and inject arbitrary shell metacharacters. Second, the analyst mounts a hostile forensic image, imports tampered artifact definitions, or ingests evidence containing the malicious strings into the UAC (Unix-like Artifacts Collector) workspace. Third, as UAC parses the evidence and invokes the _run_command function to query system artifacts or process metadata, the unsanitized input is concatenated directly into the command string executed by the shell.\nPayload behavior involves the immediate interpretation and execution of the injected shell commands by the underlying operating system shell. Post-exploitation impact includes the execution of arbitrary payloads on the analyst's host machine, potential lateral movement across internal networks from the compromised analyst workstation, unauthorized data exfiltration of sensitive forensic evidence, and complete compromise of the analysis environment."
}