Log in Start free

Vulnerability · Published Sep 18, 2024 · Assigned by GitHub_M

CVE-2024-46986Arbitrary file write leading to RCE in Camaleon CMS

Critical 10.0

In plain English

A critical-severity injection in camaleon-cms from owen2345. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 37.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)37.1%top 1.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC

Official description

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemscamaleon_cms2.8.1GHSA-wmjg-vqhv-q5p5

Affected products (as reported)

VendorProductVersions
owen2345 camaleon-cms < 2.8.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References