Pulling the right strings for RCE on a Puppet
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A red-team write-up details two critical (CVSS 9+) vulnerabilities in Puppet, one enabling remote code execution on the Puppet Server via a deserialization flaw in the report endpoint, reachable by any agent holding a client certificate, which is often easy to obtain where autosign is enabled.