## https://sploitus.com/exploit?id=BC775B35-494D-58E3-943F-78511B06599C
# CVE-2026-28672 — Apache Ranger `UnixUserGroupBuilder` OS command injection
Runnable proof-of-concept reproducer for the OS command injection in Apache Ranger's user-sync
(`unixusersync`) module.
While enumerating the groups of each synced user, `UnixUserGroupBuilder` runs the `id` command through a shell,
concatenating the **username** into the command line:
```java
// ugsync/src/main/java/org/apache/ranger/unixusersync/process/UnixUserGroupBuilder.java (Ranger 65534
[2] Malicious username 'nobody; touch /tmp/pwned-28672' (vulnerable null
injected command executed? marker exists = false
>>> PROVEN: ... OS command injection (CWE-77): true
```
## Vulnerability Summary
| Property | Value |
|----------|-------|
| **Project** | Apache Ranger — `org.apache.ranger.unixusersync` (user-sync) |
| **Class** | CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| **Attack vector** | A username containing shell metacharacters supplied by the user-sync source |
| **Impact** | Arbitrary OS command execution on the Ranger user-sync host |
| **Affected Versions** | from 0.6 through 2.8 |
| **Fixed Version** | 2.9.0 |
| **Advisory** | [lists.apache.org thread](https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7) · [CVE-2026-28672](https://vulners.com/cve/CVE-2026-28672) |
| **Credit** | Andrea Cosentino |
## The fix
Apache Ranger 2.9.0 runs `id` directly as an argument vector, so the username is a single literal argument and
is never interpreted by a shell:
```java
// Ranger 2.9.0
Process process = Runtime.getRuntime().exec(new String[] {"id", "-G", userName});
```
`UnixUserGroupBuilderVuln.java` in this repository contains both forms verbatim, cited to the upstream source.
## Disclaimer
This repository is published for educational and defensive purposes: to help Apache Ranger users understand the
vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The payload is benign
(it creates a marker file under `/tmp`). Do not use this material against systems you do not own or operate.