Live › vulnerability › CVE-2024-5023
Go to dashboardConsoleMe passes a user-supplied filename from its templated-resource self-service flow directly to a git CLI command, so a flag can be injected in place of a filename. An authenticated user can use a specific flag to make git print the contents of any file the ConsoleMe server process can read, which can expose AWS secrets held on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:25 UTC, 0h before NVD. All times on this page are UTC.
Deployments that allow templated resources, meaning cache_resource_templates.repositories is set to a non-empty list, are affected, and the flaw is reachable by any authenticated ConsoleMe user. Deployments without that setting, or with it empty, are not affected according to the advisory. Because ConsoleMe brokers AWS identities, teams running it should treat any exposed server file as a potential privilege escalation path.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| consoleme | pypi | < 1.4.0 | 1.4.0 |
cache_resource_templates.repositories; if it is set to a non-empty list, the deployment is exposed.pip show consoleme; versions below 1.4.0 are affected.consoleme PyPI package to 1.4.0 or later.cache_resource_templates.repositories from the configuration or set it to an empty array; this disables templated resources for self-service.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authenticated users can achieve limited RCE in ConsoleMe, restricted to flag inputs on a single CLI command. Due to this constraint, it is not currently known whether full RCE is possible but it is unlikely. However, a specific flag allows authenticated users to read any server files accessible by the ConsoleMe process. Given ConsoleMe's role as an AWS identity broker, accessing files containing secrets on the server could potentially be exploited for privilege escalation.
Deployments of ConsoleMe that allow templated resources are impacted and urged to patch immediately. Deployments that do not permit templated resources are not affected.
To determine if your ConsoleMe deployment uses templated resources, check the configuration value for cache_resource_templates.repositories. If this value does not exist or is an empty array, your deployment is not impacted.
The self-service flow for templated resources in ConsoleMe accepts a user-supplied JSON post body, which includes the filename for the templated resource. However, this user-supplied filename is not properly sanitized and is passed directly as a string to a CLI command. This allows users to input flags instead of filenames. By passing a specific flag with a filename value, users can induce an error that reveals the contents of the specified file, allowing them to read any files readable by the system user executing the ConsoleMe server process.
This issue has been patched in version v1.4.0 via https://github.com/Netflix/consoleme/pull/9380.
If you are unable to upgrade to the latest version, users can selectively apply the code changes in the above PR. Alternatively, removing the configuration item cache_resource_templates.repositories or adding it as an empty array should mitigate the issue, but will result in broken functionality (templated resources will no longer be supported for self-service).
This page as .md · .json · in your agent: get_signal("CVE-2024-5023")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.