Description

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T23:17:23.427Z",
  "pubdate": "2026-09-03T23:17:23.427Z",
  "executiveSummary": "MOOS-IvP through version 24.8.1 is vulnerable to a remote code execution flaw within the alogsplit utility, specifically originating from the SplitHandler::handlePreCheckSplitDir() function.\nThe vulnerability is classified as an improper neutralization of special elements used in an OS command, commonly referred to as Command Injection.\nThis flaw arises due to the application's failure to sanitize shell metacharacters present within log file paths or the --dir command-line argument.\nAn attacker can exploit this by crafting malicious log file names or providing specific input to the --dir parameter, enabling the execution of arbitrary commands with the security context and privileges of the user running alogsplit.\nThe impact of this vulnerability is critical, as it facilitates full system compromise, unauthorized data access, and persistence within the environment where the tool is executed.\nExploitation does not require authentication to the application itself; however, it necessitates the ability to influence the input processed by the utility, such as through a compromised log repository or direct user interaction.",
  "technicalDetails": "The vulnerability resides in the SplitHandler::handlePreCheckSplitDir() function of the alogsplit component, which is responsible for validating and organizing log directories. During the initialization phase, the utility parses input paths to verify directory structures.\nThe root cause is a failure to perform input validation or sanitization on file paths before passing them to system-level calls or shell-invoked processes. By injecting shell metacharacters—such as backticks, semicolons, pipe symbols, or command substitution operators—into the path structure, an attacker can break out of the intended function's logical flow.\nThe attack flow begins when alogsplit processes a malicious directory path containing command strings. When the application invokes a system call to interact with the file system (e.g., executing shell-based utilities to copy, move, or list files), the unvalidated input is parsed by the shell environment. Because the metacharacters are treated as command separators or execution triggers, the injected payload is executed alongside the legitimate utility commands.\nSpecifically, the --dir argument or any path provided to the utility is improperly handled, leading to a direct Command Injection scenario. This implies that the application lacks a secure API for file system operations, instead relying on unsafe string concatenation to construct shell commands.\nPost-exploitation, the injected commands execute with the same privilege level as the operator of alogsplit. If the operator possesses elevated privileges, the attacker can leverage this to escalate their control over the host system. This allows for arbitrary code execution, including the installation of malicious software, data exfiltration, or lateral movement within the target network.\nBecause the utility is designed to process log files, an attacker could potentially weaponize a legitimate-looking but malicious log file that, when parsed by a victim's alogsplit installation, triggers the vulnerability automatically without explicit user intent to execute code."
}