Heketi Arbitrary Code Execution

Also known as GHSA-6g56-v9qg-jp92, GO-2024-2763

Published 8 y ago 2017-12-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

5.5%

percentile 93%

Public exploits

none known

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.

Exploit prediction (EPSS)

5.50% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.0	`AV:N/AC:L/Au:S/C:C/I:C/A:C`
GitHub	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/heketi/heketi`	<5.0.1 <5.0.1+incompatible	5.0.1 5.0.1+incompatible

Affected products

Heketi Heketi

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-20 Improper Input Validation
CWE-94 Improper Control of Generation of Code

References

bugzilla.redhat.com /show_bug.cgi?id=1510147 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:3481 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /security/cve/CVE-2017-15103 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-15103 · advisory
github.com /heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00 · web
github.com /heketi/heketi · package
github.com /heketi/heketi/releases/tag/v5.0.1 · web
github.com /advisories/GHSA-6g56-v9qg-jp92 · advisory

Sources

CVE List: CVE-2017-15103
GitHub Advisory: GHSA-6g56-v9qg-jp92
NVD: CVE-2017-15103
OSV: GO-2024-2763

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary