Vulnerability · Published Jul 10, 2024 · Assigned by CERT-PL

CVE-2024-3799Shell command injection in Phoniebox

High 8.7

In plain English

A high-severity OS command injection in Phoniebox from Phoniebox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.6% (higher than 97% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)14.6%top 3.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause a shell command execution. This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.

Affected products (as reported)

Vendor	Product	Versions
Phoniebox	Phoniebox	0 – through 2.7

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2024/07/CVE-2024-3798 third-party-advisory
https://cert.pl/posts/2024/07/CVE-2024-3798 third-party-advisory
https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2342 issue-tracking