Vulnerability · Published Jul 10, 2024 · Assigned by CERT-PL

CVE-2024-3798Insecure handling of GET argument in Phoniebox

High 8.7

In plain English

A high-severity cross-site request forgery in Phoniebox from Phoniebox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause one of the following (depending on the chosen payload): shell command execution, reflected XSS or cross-site request forgery. This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.

Affected products (as reported)

Vendor	Product	Versions
Phoniebox	Phoniebox	0 – through 2.7

Weakness: CWE-352, CWE-79, CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://cert.pl/en/posts/2024/07/CVE-2024-3798 third-party-advisory
https://cert.pl/posts/2024/07/CVE-2024-3798 third-party-advisory
https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2342 issue-tracking