CVE-2024-22116

What it actually does

Lack of default escaping on script parameters in the Monitoring Hosts section allows a restricted administrator to inject and execute arbitrary operating system commands via the Ping script functionality.

Why it matters to the business

Compromised infrastructure through arbitrary code execution by accounts that should have limited access, potentially leading to full system control despite the age of the issue and low observed exploitation rates.

How an attack unfolds

A restricted administrator authenticates, navigates to the Monitoring Hosts section, crafts a malicious payload in the Ping script parameters that bypasses the missing escaping, and executes arbitrary commands on the host.

How to fix it

Upgrade affected AlmaLinux 8 packages to the listed fixed versions: apcu-panel to 5.1.17-1.module_el8.3.0+2009+b272fdef, libzip to 1.5.2-1.module_el8.5.0+152+112d3b8c, libzip-devel to 1.5.2-1.module_el8.4.0+2229+b272fdef, libzip-tools to 1.5.2-1.module_el8.5.0+152+112d3b8c, php-pear to 1:1.10.9-1.module_el8.3.0+2009+b272fdef, php-pecl-apcu to 5.1.17-1.module_el8.5.0+152+112d3b8c, php-pecl-apcu-devel to 5.1.17-1.module_el8.3.0+2009+b272fdef, and php-pecl-zip to 1.15.4-1.module_el8.4.0+2229+b272fdef. Apply input escaping or disable script execution for restricted roles where upgrades are delayed.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed versions listed for each affected AlmaLinux 8 component and test that script parameters are properly escaped in the Monitoring Hosts section.

Typical attack path

1. Authenticate with a restricted administrator account
2. Access the Monitoring Hosts configuration section
3. Modify Ping script parameters to include command injection payload
4. Trigger script execution to run arbitrary commands on the target host

How to detect it

Review application and system logs for unexpected command executions originating from the Ping script in Monitoring Hosts; examine audit trails for parameter values containing shell metacharacters or unusual process spawns triggered by restricted accounts.

What your security team should do

• Immediately upgrade all listed packages to the specified fixed versions
• Review and restrict script execution permissions for administrator accounts
• Monitor for any post-patch anomalies in host monitoring activity