title: Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
description: Upload profile either
through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec
check command with maliciously crafted profile allows remote code execution.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
collectionURL: https://www.chef.io/downloads
defaultStatus: affected
modules: Automate Upload Profile
packageName: Automate
platforms: Linux
product: Chef Automate
repo: https://github.com/chef/automate
vendor: Progress Software Corporation
versions:
lessThanOrEqual: 4.10.29, status: affected, version: 4.0.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Solution (optional): Customers should adopt the latest releases of Automate available from the customer downloads portal.
workarounds:
Workaround (optional): Chef recommends all users to manually inspect and lint with a tool similar to test-kitchen all profiles and cookbooks prior to usage in production.