Description

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-17T15:16:57.730Z",
  "pubdate": "2026-08-17T15:16:57.730Z",
  "executiveSummary": "A vulnerability exists within the openshift-metal3/fakefish repository involving the unsafe handling of shell variables across multiple scripts. The root issue stems from the injection of unquoted shell variables directly into command lines and manifests. Specifically, this vulnerability applies to critical parameters such as the Image URL and BMC credentials, which are processed without proper validation or sanitization by FakeFish.\nThe primary impact of this flaw includes potential command injection vectors and arbitrary execution risks within the execution context of the affected scripts. Attackers capable of manipulating input parameters such as Image URLs or BMC credentials can exploit unquoted variable expansions to inject malicious shell commands or payload arguments. This threatens the integrity and confidentiality of the host environment running the scripts.\nAffected systems comprise deployments utilizing openshift-metal3/fakefish where administrative or automated scripts parse unverified external inputs. The risk implication is significant as it allows attackers to leverage inadequately bounded variable expansions to execute arbitrary commands. Exploitation relies on the ability to supply crafted values to unverified parameters like Image URLs or BMC credentials during script execution.",
  "technicalDetails": "The vulnerability resides in the script execution logic of openshift-metal3/fakefish where shell variables are referenced without enclosing double quotes or utilizing proper parameter sanitization techniques. The vulnerable components are specific shell scripts within the codebase that construct command lines and configuration manifests dynamically by concatenating raw variable values.\nThe root cause is improper neutralization of special characters during variable expansion. In Unix-like shells, unquoted variables are subject to word splitting and filename expansion (globbing), as well as direct command substitution if the supplied string contains metacharacters such as backticks, semicolons, or pipe symbols.\nThe attack flow proceeds as follows: 1. An attacker or an untrusted external source supplies a malicious payload containing shell metacharacters via parameters designated for the Image URL or BMC credentials. 2. The affected script reads the unverified input into a shell variable. 3. During execution, the script evaluates the unquoted variable within a command string or manifest generation routine. 4. Due to the lack of quotes, the shell interprets the injected metacharacters as syntax rather than literal data. 5. This results in the execution of arbitrary commands or unintended manipulation of manifest structures under the execution privileges of the script.\nAuthentication and privilege requirements depend on the execution context of the vulnerable scripts, typically requiring the capability to supply or manipulate configuration inputs such as BMC settings or image endpoints. The network exposure is dictated by where the FakeFish service or its provisioning scripts accept parameters from external or untrusted API calls and configuration files."
}