Vulnerability · Published Jul 19, 2024 · Assigned by GitHub_M

CVE-2024-39906Remote code execution in Haven IndieAuthClient (GHSL-2024-093)

High 8.4

In plain English

A high-severity injection in haven from havenweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)1.0%top 36.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
havenweb	haven	< c52f07c

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/havenweb/haven/security/advisories/GHSA-65cm-7g24-hm9f x_refsource_CONFIRM
https://github.com/havenweb/haven/commit/c52f07c x_refsource_MISC