Vulnerability · Published Jun 24, 2024 · Assigned by CERT-PL

CVE-2024-4748RCE in Cruddiy

High 8.8

In plain English

A high-severity OS command injection in CRUDDIY from CRUDDIY. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.1%top 33.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which would send such a malicious request to the locally launched server.

Affected products (as reported)

Vendor	Product	Versions
CRUDDIY	CRUDDIY	0 – through 202312.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://cert.pl/en/posts/2024/06/CVE-2024-4748 third-party-advisory
https://cert.pl/posts/2024/06/CVE-2024-4748 third-party-advisory
https://github.com/jan-vandenberg/cruddiy/issues/67 issue-tracking