Detect GNU InetUtils Argument Injection Vulnerability (CVE-2026-24061) in Elastic Security
CVE-2026-24061 is an argument injection vulnerability (CWE-88) in GNU InetUtils affecting utilities such as telnet, ftp, rsh, rcp, and related tools. An attacker who can control arguments passed to InetUtils binaries may inject additional command-line options, potentially enabling unauthorized network access, privilege escalation, or lateral movement. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
Elastic Detection Query
process where event.type == "start"
and process.name in ("telnet", "ftp", "rsh", "rcp", "rlogin", "tftp", "ping", "traceroute")
and (
process.args : ("-*=*", "*%0a*", "*%0d*", "*\\n*", "*\\r*")
or process.command_line : ("*; bash*", "*; sh*", "*; nc*", "*; curl*", "*; wget*", "*; python*", "*; perl*")
)EQL sequence detecting GNU InetUtils binaries launched with argument injection patterns indicative of CVE-2026-24061 exploitation, covering newline injection, option-value injection, and shell command chaining.
Data Sources
Required Tables
False Positives & Tuning
- Automated FTP scripts using special characters in file paths or credentials
- Network monitoring utilities that pass diagnostic flags resembling injection patterns
- Security audit tools scanning for InetUtils argument handling weaknesses
Other platforms for CVE-2026-24061
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1InetUtils telnet argument injection via newline encoding
Expected signal: Auditd EXECVE record showing argv[1] containing a newline character followed by '-l root'; process event logs capturing the raw command-line string with embedded newline.
- Test 2InetUtils ftp option-value injection via concatenated argument
Expected signal: Process execution event showing ftp launched with argument '-o-p', captured by auditd EXECVE or EDR process telemetry.
- Test 3InetUtils rsh argument injection leading to shell spawning
Expected signal: Process launch event for rsh with semicolon-delimited command in arguments; potential child process event for shell spawned to execute 'id'; file creation event for /tmp/argus_injection_test.txt.
Response Playbook
Triage
- Identify the specific InetUtils binary involved (telnet, ftp, rsh, rcp, rlogin, tftp) and retrieve the full command-line arguments from endpoint telemetry to confirm injection pattern.
- Determine whether the process was spawned interactively by a user or by an automated process/service; review parent process chain for anomalies such as web servers, cron jobs, or scripting engines launching InetUtils.
- Check if any downstream child processes were spawned by the InetUtils binary (e.g., bash, sh, nc), which would confirm successful argument injection and possible code execution.
- Cross-reference the source host against asset inventory to determine criticality and whether it is Internet-facing or holds privileged roles (jump box, build server, CI/CD node).
Containment
- If successful code execution is confirmed, isolate the affected host via EDR quarantine or network ACL and revoke any credentials used during or after the suspicious InetUtils invocation.
- Disable or remove the vulnerable InetUtils binaries from affected systems using package management (e.g., apt remove inetutils-telnet inetutils-ftp) and replace legacy utilities with safer alternatives (openssh-client, lftp).
Evidence Collection
- Collect full process execution logs including command-line arguments, environment variables, PPID chain, and spawn time from the EDR or auditd for forensic review.
- Capture network connection records (netflow, firewall logs) for the affected host during the injection window to identify any C2 callbacks or lateral movement connections initiated via the injected arguments.
Escalation Criteria
- !Escalate immediately if a child process consistent with a reverse shell (nc, bash -i, python -c socket, etc.) was spawned by any InetUtils binary, indicating active exploitation.
- !Escalate if the injection was observed on a privileged host (domain controller, CI/CD server, secrets management node, or production database) or if credentials for privileged accounts were accessed post-injection.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Linux auditd EXECVE records containing the full argv[] array for the InetUtils process, which will show injected arguments as discrete elements rather than a single concatenated string. - >
Shell history files (~/.bash_history, ~/.zsh_history) on the host if an interactive user session was involved, potentially showing the precursor commands used to craft the injection. - >
Network capture (pcap) from the host during the event window to examine what connections were actually initiated versus what the caller intended.
Tuning Guidance
Start by baselining all legitimate InetUtils invocations in your environment — in modern environments these utilities are rarely used interactively and almost never in production workloads. High-fidelity environments can suppress alerts where the parent process is a known, version-pinned automation binary (e.g., a specific Ansible runner path) and no shell metacharacters appear in arguments. Increase confidence to 'high' if your environment has already patched InetUtils and alerts fire on unpatched hosts. Consider suppressing ftp alerts on known file-transfer servers with dedicated FTP solutions, but retain alerting for any shell-spawning child processes regardless of parent.
Hunting Queries
Threat hunt for InetUtils utilities launched by scripting engines or schedulers, which is the typical delivery pattern for argument injection attacks — the attacker controls script input that is passed unsanitized to an InetUtils binary.
DeviceProcessEvents
| where FileName in~ ("telnet", "ftp", "rsh", "rcp", "rlogin", "tftp")
| where InitiatingProcessFileName in~ ("cron", "crond", "bash", "sh", "python", "perl", "php", "node", "ruby", "java")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by TimeGenerated descindex=* sourcetype IN ("linux_audit", "syslog") ("telnet" OR "ftp" OR "rsh" OR "rcp" OR "rlogin")
| eval parent=coalesce(ParentProcessName, parent_process)
| where parent IN ("cron", "crond", "bash", "sh", "python", "perl", "php", "node", "ruby")
| table _time, host, user, parent, process, cmd
| sort - _timeAtomic Red Team Tests
Simulates CVE-2026-24061 by passing a newline-encoded argument to telnet that injects an additional option, demonstrating how unsanitized user-controlled input can alter InetUtils behavior.
Command
telnet $'127.0.0.1\n-l root' 23 || trueCleanup
pkill telnet || trueExpected Telemetry
Auditd EXECVE record showing argv[1] containing a newline character followed by '-l root'; process event logs capturing the raw command-line string with embedded newline.
Expected Detection
Detection fires on newline injection pattern (\n) in telnet command-line arguments.
Demonstrates argument injection into GNU ftp by appending an unexpected -p (passive mode) flag via a concatenated option-value string, simulating how attacker-controlled input could alter FTP session behavior.
Command
ftp -v '-o-p' 127.0.0.1 2>/dev/null || trueCleanup
pkill ftp || trueExpected Telemetry
Process execution event showing ftp launched with argument '-o-p', captured by auditd EXECVE or EDR process telemetry.
Expected Detection
Detection fires on option-injection regex matching '-[a-zA-Z]=' or combined option flags in ftp command-line.
Simulates a worst-case CVE-2026-24061 scenario where injected arguments to rsh result in a shell command being executed, representing post-exploitation behavior where code execution is achieved via argument injection.
Command
rsh 127.0.0.1 '; id > /tmp/argus_injection_test.txt' 2>/dev/null || trueCleanup
rm -f /tmp/argus_injection_test.txt; pkill rsh || trueExpected Telemetry
Process launch event for rsh with semicolon-delimited command in arguments; potential child process event for shell spawned to execute 'id'; file creation event for /tmp/argus_injection_test.txt.
Expected Detection
Detection fires on shell-spawn injection pattern ('; id') in rsh command-line, classified as shell_spawn injection type in CrowdStrike CQL enrichment.