They allow RCE on the puppet management server in a default configuration. Also, we discovered a Puppet host impersonation vulnerability in a non-default but commonly used configuration. Both vulnerabilities were responsibly disclosed to the vendors, who has since addressed them in newer versions of Puppet.
Puppet is a software configuration management software widely used in big companies to provision software and patch servers. It uses a client- (“agent”) and server-based architecture, where the agent pulls the desired software and configuration state from the server. The software packages are described in a declarative language, while the software stack runs mainly on Ruby.
