Unix-Like Artifacts Collector - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/unix-like-artifacts-collector/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 21 Aug 2026 19:26:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection in Unix-like Artifacts Collectorhttps://feed.craftedsignal.io/briefs/2026-08-uac-command-injection/Fri, 21 Aug 2026 19:26:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-uac-command-injection/Unix-like Artifacts Collector (UAC) versions prior to 3.3.0 are vulnerable to command injection via the _command_collector function, allowing arbitrary command execution through malicious filenames or artifact definitions.Unix-like Artifacts Collector (UAC) versions prior to 3.3.0 contain a command injection vulnerability within the _command_collector function. The vulnerability arises because lines of command output are processed through a sed command and subsequently evaluated using the shell eval command without sufficient input sanitization. An attacker capable of influencing the filenames or the contents of artifact definitions can inject shell metacharacters, such as command substitution syntax or semicolons, to execute arbitrary code with the privileges of the user running the collection script. This poses a significant risk to forensic analysts, as UAC is frequently executed on compromised systems where malicious artifacts may be present specifically to target investigative tooling.

Attack Chain

  1. An attacker gains initial access to a target system and anticipates forensic investigation using UAC.
  2. The attacker creates malicious files or modifies artifact definitions containing shell metacharacters (e.g., $(id), ;rm -rf /).
  3. A forensic analyst initiates a UAC collection run on the compromised host.
  4. The UAC script invokes the _command_collector function to process system artifacts.
  5. The collector reads the attacker-controlled filenames or artifact contents containing the malicious payload.
  6. The vulnerability in _command_collector passes these strings through sed and subsequently to eval without escaping.
  7. The shell interprets the injected metacharacters, executing arbitrary commands under the context of the user running the UAC script.

Impact

Successful exploitation allows for arbitrary command execution on the analyst's machine. Given that UAC is intended for forensic acquisition, this vulnerability could be used by an attacker to compromise the forensic workstation, potentially leading to the modification of evidence, exfiltration of collected forensic data, or lateral movement within the incident response infrastructure.

Recommendation

Prioritized, concrete actions for detection engineering teams:

  • Upgrade all instances of UAC to version 3.3.0 or later to patch the underlying vulnerability in _command_collector.
  • Audit existing custom artifact definitions for shell metacharacters and unusual patterns that could trigger the eval-based injection.
  • Monitor execution logs for UAC processes where the command line contains suspicious shell operators, which may indicate an attempt to weaponize artifact collection against an analyst.
]]>highadvisoryvulnerabilitycommand-injectionforensic-tooling