Description
OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rapid7 | InsightConnect Traceroute Plugin | < 1.0.3 | 1.0.3 |
References
- https://extensions.rapid7.com/extension/traceroute vendor-advisory