Description
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
Problem types
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Product status
2018.1.8 (custom)
Credits
TIM Security Red Team Research - https://www.gruppotim.it/it/footer/red-team.html
Marco Ventura
Claudia Bartolini
Andrea Carlo Maria Dattola
Stefano Carbè
Massimiliano Brolli
References
portal.perforce.com/s/detail/a91PA000001SiDdYAK