The Puppet Labs Issue Tracker has Moved:

This issue tracker is now in read-only archive mode and automatic ticket export has been disabled. Redmine users will need to create a new JIRA account to file tickets using See the following page for information on filing tickets with JIRA:

Bug #13518

Updated by Matthaus Owens about 4 years ago

This requires access to the cert on the agent and an unprivileged account on the master.

By creating a path on the master in a world-writable location that matches a command string, one can then make a file bucket request to execute that command.
Zero day goes here