Shell Command Injection Vulnerability in KDE Plasma Workspace
CVE-2018-6791
Key Information:
- Vendor
Kde
- Status
- Vendor
- CVE Published:
- 7 February 2018
Badges
What is CVE-2018-6791?
A command injection issue was identified in the KDE Plasma Workspace, specifically within the device service management component. When a vfat thumbdrive with a specially crafted volume label (including characters such as `` or $()) is mounted, the system interprets this as a shell command. This unexpected behavior can lead to the execution of arbitrary commands, potentially compromising the system's security. For instance, a volume label like '$(touch b)' could create an unwanted file in the user's home directory. Users are advised to upgrade to KDE Plasma Workspace version 5.12.0 or later to mitigate this risk.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.