Arbitrary eval through MiqExpression
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ManageIQ | manageiq | < jansa-4; < kasparov-2; < lasker-1 | — | No fix listed | CNA |
- manageiq VendorManageIQ Affected < jansa-4; < kasparov-2; < lasker-1 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:manageiq:manageiq:jansa-1:-:*:*:*:*:*:* | jansa-1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-1:alpha1:*:*:*:*:*:* | jansa-1 alpha1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-1:beta1:*:*:*:*:*:* | jansa-1 beta1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-1:rc1:*:*:*:*:*:* | jansa-1 rc1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-1:rc2:*:*:*:*:*:* | jansa-1 rc2 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-2:*:*:*:*:*:*:* | jansa-2 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:jansa-3:*:*:*:*:*:*:* | jansa-3 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:kasparov-1:-:*:*:*:*:*:* | kasparov-1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:kasparov-1:alpha1:*:*:*:*:*:* | kasparov-1 alpha1 | Vulnerable | ManageIQ |
| cpe:2.3:a:manageiq:manageiq:kasparov-1:beta1:*:*:*:*:*:* | kasparov-1 beta1 | Vulnerable | ManageIQ |
- cpe:2.3:a:manageiq:manageiq:jansa-1:-:*:*:*:*:*:* Versions jansa-1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-1:alpha1:*:*:*:*:*:* Versions jansa-1 alpha1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-1:beta1:*:*:*:*:*:* Versions jansa-1 beta1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-1:rc1:*:*:*:*:*:* Versions jansa-1 rc1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-1:rc2:*:*:*:*:*:* Versions jansa-1 rc2 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-2:*:*:*:*:*:*:* Versions jansa-2 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:jansa-3:*:*:*:*:*:*:* Versions jansa-3 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:kasparov-1:-:*:*:*:*:*:* Versions kasparov-1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:kasparov-1:alpha1:*:*:*:*:*:* Versions kasparov-1 alpha1 Vulnerable ·ManageIQ
- cpe:2.3:a:manageiq:manageiq:kasparov-1:beta1:*:*:*:*:*:* Versions kasparov-1 beta1 Vulnerable ·ManageIQ
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32756
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences