U.S. Election Assistance Commission Website Disclosed to Have Critical Remote Code Execution Vulnerability

Odaily reports: Cybersecurity firm XBOW has disclosed that it discovered a critical-severity remote code execution vulnerability that can be exploited without authentication in a public web application of the U.S. Election Assistance Commission (EAC). The application is used for resource and logistics calculations and is not a voting machine or voter registration system. The vulnerability could allow attackers to execute code with root privileges in a backend container by crafting a specific web request, and to access locally protected resources and external networks. XBOW stated that it reported the issue in accordance with the vulnerability disclosure policy published by the EAC, and that, after verification by the EAC team, the vulnerability was fixed before the U.S. federal midterm elections.