CVE-2026-8662

Executive Summary

CVE-2026-8662 is a path traversal vulnerability in the create_archive function of the Rapid7 InsightConnect Compression Plugin on Linux. An authenticated attacker can craft a filename input to write archive files to unintended directories, leading to file corruption. The CVSS score is 3.3 (Low), and the EPSS probability is 0.0%, indicating low exploitation likelihood. No public proof-of-concept or patch details are available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs authenticated access.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: Low (I:L) – file corruption possible, but content not controlled.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Low. The vulnerability requires authenticated access and only allows file corruption, not arbitrary write or code execution.

Deep Dive & Mechanics

The vulnerability resides in the create_archive function of the InsightConnect Compression Plugin. When creating an archive, the plugin does not properly sanitize user-supplied filenames. On Linux systems, path traversal sequences (e.g., ../) can be injected into the filename, causing the archive to be written to unintended locations. The attacker cannot control the content of the written file, only its location, limiting the impact to file corruption.

Root Cause: Insufficient input validation on the filename parameter before passing it to the archive creation routine.

Attack Scenario: An authenticated user with access to the plugin can craft a filename like ../../etc/malicious.tar to write an archive to /etc/. The archive content is determined by the plugin, not the attacker, so only existing files can be overwritten or corrupted.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code likely resembles:

def create_archive(files, archive_name):
    # Vulnerable: no sanitization of archive_name
    with tarfile.open(archive_name, "w") as tar:
        for f in files:
            tar.add(f)

A patched version would sanitize the archive name:

import os

def create_archive(files, archive_name):
    # Sanitize: ensure archive_name is a simple filename
    safe_name = os.path.basename(archive_name)
    safe_path = os.path.join("/safe/directory", safe_name)
    with tarfile.open(safe_path, "w") as tar:
        for f in files:
            tar.add(f)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an InsightConnect instance with the Compression Plugin enabled.
• Authenticated user credentials.

Exploitation Steps:

1. Identify the plugin endpoint that accepts archive creation requests.
2. Craft a request with a filename containing path traversal, e.g., ../../tmp/evil.tar.
3. Submit the request. The archive will be written to /tmp/evil.tar.
4. Verify file creation in the target directory.

Example Request (cURL):

curl -X POST -H "Authorization: Bearer <token>" \
  -d '{"files": ["/data/file1.txt"], "archive_name": "../../tmp/evil.tar"}' \
  https://insightconnect.example.com/api/compress

Blue Team

Detection:

• Monitor for unusual file creation events in sensitive directories (e.g., /etc, /tmp, /var/www).
• Audit plugin logs for filenames containing ../ or absolute paths.
• Use file integrity monitoring (FIM) to detect unexpected changes.

Mitigation:

• Restrict plugin execution to a sandboxed directory.
• Apply strict input validation on all filename parameters.
• Implement allowlists for allowed output directories.

Indicators of Compromise (IOCs)

• File Paths:
  • /etc/*.tar, /tmp/*.tar, /var/www/*.tar (unexpected archive files)
• Log Entries:
  • Plugin logs containing ../ or absolute paths in the archive_name field.
• Network:
  • No specific network IOCs; exploitation is local.

Detection Engineering

YARA Rule

rule CVE_2026_8662_PathTraversal {
    meta:
        description = "Detects path traversal attempts in InsightConnect Compression Plugin logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8662"
    strings:
        $traversal = /\.\.\// nocase
        $archive_ext = /\.(tar|gz|zip|bz2)/ nocase
    condition:
        $traversal and $archive_ext
}

Sigma Rule

title: CVE-2026-8662 Path Traversal in InsightConnect Compression Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in InsightConnect Compression Plugin logs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8662
logsource:
    product: insightconnect
    service: compression_plugin
detection:
    selection:
        EventID: 1001
        Message|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in controlled environments
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-8662 Path Traversal in InsightConnect Compression Plugin";
    flow:to_server,established;
    content:"../"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Compression Plugin if not essential.
2. Restrict plugin execution to a dedicated, sandboxed directory.
3. Implement strict input validation on the archive_name parameter.

Long-Term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of the plugin.
• Conduct a security review of all plugin input handling.

Workaround:

• Use a web application firewall (WAF) to block requests containing ../ in the filename parameter.
• Monitor file system changes in sensitive directories.

Valters IT