Does your Komodo Periphery agent allow root command injection via container names?
Komodo Periphery versions up to 2.2.0 contain an OS command injection flaw that allows authenticated non-admin users to execute arbitrary commands as root on the host server.
Key points
- Versions 2.3.0 and higher include a patch for the OS command injection vulnerability in Komodo Periphery.
- The flaw affects container destruction and log search operations due to missing input validation.
- Only installations with non-admin users holding specific grants are exposed to this privilege escalation.
The short version
- Komodo Periphery agents running versions 2.2.0 or lower are vulnerable to OS command injection.
- Authenticated non-admin users can escalate privileges to root by injecting malicious container names.
- A fix is available in version 2.3.0; CERT/CC recommends immediate updates for affected deployments.
The details
Komodo Periphery is an agent service within the Komodo server management platform, maintained by mogh.tech. According to CERT/CC advisory VU#456950, versions 2.2.0 and earlier fail to validate user-supplied Docker container names. These unvalidated names are interpolated directly into shell commands executed by the agent. The vulnerability manifests through two primary vectors: container destruction and container log searches. In both cases, raw input is inserted into sh -c command lines without shell escaping.
The context
The flaw allows an authenticated non-admin user to execute arbitrary commands as root on the underlying host. This occurs because the Periphery agent runs with root privileges on the host OS and Docker socket. CERT/CC notes that this is a privilege escalation within Komodo’s permission model. It is not remotely exploitable without an account. Installations using only admin users are not affected by this specific vector.
Next steps
CERT/CC states that Komodo has implemented a patch in versions 2.3.0 and higher. The advisory recommends all users update immediately to remediate the issue. Muhammadjon Ahmadjonov reported the vulnerability. Alex Lewis wrote the CERT/CC document. Teams should verify their Periphery agent version against this threshold.
What defenders should look for
Teams usually monitor for unexpected shell processes spawned by the Periphery agent. Check whether container deletion or log search requests correlate with new root-level command executions. Look for anomalous network connections originating from the host after these operations. Verify that only authorised users interact with container management endpoints. Inspect audit logs for privilege escalation events tied to non-admin accounts.
What to do and how to stay safe: Komodo
- Audit your Komodo Periphery agent versions and upgrade to 2.3.0 or higher if you are running an earlier release.
- Review user permissions to ensure non-admin users only hold necessary grants for container management and log access.
- Monitor host-level process creation logs for unexpected shell commands initiated by the Periphery service.
- Verify that Periphery instances are not directly exposed to unauthenticated networks without passkey protection.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Komodo Periphery versions are affected by this command injection flaw?
All versions prior to 2.3.0 are vulnerable to OS command injection via container names.
Can an unauthenticated attacker exploit this vulnerability?
No, exploitation requires an authenticated account with specific grants; unauthenticated attackers cannot reach these endpoints.
Is there a patch available for this issue?
Yes, Komodo has released a fix in version 2.3.0 and higher, which CERT/CC recommends installing immediately.
