CFEngine Hub VCS gitServer injection RCE

OAuth2 admin token then POST /api/vcs/settings injects $cmd into params.sh; execution when masterfiles-stage.sh is sourced hub deploy/cf-agent. !/usr/bin/env python3 -- coding: utf-8 -- """CFEngine Nova Hub VCS settings gitServer command injection.""" from future import annotations import json...