Technical impact
Authenticated users can create rules that embed Go or Lua scripts, which Magistrala executes server‑side when IoT messages arrive. The Lua script engine performs no input validation and preloads dangerous libraries: db for arbitrary database access, ioutil for file input/output, an HTTP client that enables SSRF, and filepath that allows directory traversal. Because the scripts run with server privileges, an attacker can execute arbitrary code, read or modify files, access databases, or reach internal services, leading to compromise of confidentiality, integrity, and availability.
Affected Systems
The vulnerability affects Magistrala, the IoT platform provided by absmach. No specific version information is supplied in the CVE, so any deployment that includes the described Rules Engine should be considered potentially vulnerable unless the vendor confirms that the issue has been resolved in the release in use.
Risk and Exploitability
With a CVSS score of 8.8 the flaw is categorized as High. An attacker only needs to be an authenticated, low‑privileged user to craft a rule that contains malicious code; once a message triggers the rule the code executes with the server’s privileges. The EPSS score of 0.00288 (< 1%) and the absence of a KEV listing do not reduce the severity, and the attack path is straightforward, indicating a high likelihood of exploitation in an environment where the Rules Engine is enabled.
