Description

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons through crafted usernames or home directory paths in /etc/passwd entries to execute arbitrary commands on the analyst's host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-21T18:16:48.400Z",
  "pubdate": "2026-08-21T18:16:48.400Z",
  "executiveSummary": "A command injection vulnerability exists in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0.\nThe flaw resides in the user substitution logic within the parse_artifact.sh script, where data retrieved from /etc/passwd is improperly handled.\nSpecifically, usernames and home directory paths are substituted directly into command strings without adequate sanitization or escaping prior to execution via the eval command.\nThis vulnerability allows local attackers capable of manipulating or supplying crafted /etc/passwd entries—or compromising local system user data processed by the collector—to execute arbitrary shell commands on the analyst's host system.\nThe risk implication is severe, as forensic analysts routinely ingest foreign or compromised disk images, mounted filesystems, or exported artifacts where malicious local account configurations may be present.\nSuccessful exploitation compromises the integrity and confidentiality of the analysis environment, potentially leading to host takeover under the privileges of the running UAC process.",
  "technicalDetails": "The vulnerability is rooted in insecure command construction and execution within the parse_artifact.sh script of UAC (Unix-like Artifacts Collector) prior to version 3.3.0.\nThe vulnerable component is the user substitution logic responsible for processing user account information derived from the target system's /etc/passwd file.\nDuring execution, the script extracts usernames and home directory paths and incorporates them directly into internal command strings.\nThese constructed strings are subsequently evaluated and executed using the shell builtin eval function without prior escaping of shell metacharacters.\nAn attacker can exploit this behavior by creating or modifying user account entries within /etc/passwd containing malicious shell metacharacters, such as command substitution syntax (e.g., backticks or $()) or command separators (e.g., semicolons).\nThe attack flow proceeds as follows: 1) The analyst mounts or supplies a forensic artifact containing a crafted /etc/passwd file; 2) UAC executes parse_artifact.sh to parse the system artifacts; 3) The script reads the malicious username or home directory path; 4) The untrusted string is concatenated into a command string destined for eval; 5) The shell interprets the embedded metacharacters, breaking out of the intended argument context; 6) Arbitrary commands supplied by the attacker execute on the analyst's host system with the privilege level of the user running UAC.\nAffected versions include all UAC (Unix-like Artifacts Collector) releases prior to 3.3.0.\nExploitation requires the processing of a compromised or maliciously crafted filesystem or artifact set containing a manipulated /etc/passwd file, typically encountered during incident response or forensic investigations."
}