Vulnerability · Published Sep 6, 2024 · Assigned by VulnCheck

CVE-2024-8517SPIP Bigup Multipart File Upload OS Command Injection

Critical 9.8

In plain English

A critical-severity OS command injection in SPIP from SPIP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 94.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)94.5%top 0.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	spip	4.3.2+dfsg-1	DEBIAN-CVE-2024-8517
Debian:14	spip	4.3.2+dfsg-1	DEBIAN-CVE-2024-8517
Ubuntu:22.04:LTS	spip	no fix listed	UBUNTU-CVE-2024-8517
Ubuntu:24.04:LTS	spip	no fix listed	UBUNTU-CVE-2024-8517

Affected products (as reported)

Vendor	Product	Versions
SPIP	SPIP	4.3.0 – through 4.3.14.2.0 – through 4.2.154.1.0 – before 4.1.18

Weakness: CWE-73, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/ exploit, technical-description
https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html vendor-advisory
https://vulncheck.com/advisories/spip-upload-rce third-party-advisory
https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/ exploit, technical-description