Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in SOCFortress CoPilot could allow a low-privilege user to execute arbitrary code on the server, potentially exposing all customer data and credentials. The issue stems from how case report templates are processed, allowing malicious content to be executed when reports are generated.
- Malicious templates can run harmful code.
- Critical security data could be exposed.
- Confirm relevance and exposure across deployments.
Attack Path
How an attacker could exploit the issue
An attacker with low-privilege access can upload a malicious case-report template. This template is later processed by an un-sandboxed engine when an administrator or analyst generates a report, allowing the attacker's code to execute on the backend with root privileges. This can lead to the exposure of all sensitive data, including tenant incident and SIEM data, as well as stored connector credentials, and potentially allow access to internal services.
- Low-privilege user can upload template.
- Report generation executes template code.
- Full system compromise and data theft.
Live Threat
Current exploitation, exposure, and threat context
When case-report templates are uploaded by low-privilege users, they can be maliciously crafted to execute arbitrary code on the server when processed by administrators or analysts. This occurs because the application does not sufficiently validate template content, allowing for the injection of malicious Jinja2 expressions that are then evaluated by a non-sandboxed engine. The reported deployment executes commands as root, potentially exposing all tenants' incident and security information and stored connector credentials. The HTML/PDF renderer also permits local-file reads and requests to internal services.
- Tenant incident and SIEM data at risk.
- Template execution via report generation.
- Full system compromise and data exposure.
Operational Fix
Recommended remediation, mitigation, and detection steps
The SOCFortress CoPilot platform's application owner and platform team are likely responsible for addressing this critical vulnerability. The first practical step is to identify all instances of CoPilot, confirm their reachability and business criticality, and then verify the current version to plan remediation.
- Application and platform teams own the fix.
- Verify CoPilot installation and version.
- Plan upgrades during maintenance windows.
