PT-2021-22431 · Cachet · Cachet

Thomas Chauchefoin · Published 2021-08-27 · Updated 2022-12-21 · CVE-2021-39173

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.5.1

Description Cachet is an open source status page system. Authenticated users, regardless of their privileges, can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed by improving the middleware ReadyForUse, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access the administration dashboard.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the administration dashboard by only allowing trusted source IP addresses.

Exploit

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2021-39173

GHSA-R67M-M8C7-JP83

Affected Products

Cachet

References · 9

• 🔥 https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection · Exploit
• https://osv.dev/vulnerability/CVE-2021-39173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39173 · Security Note
• https://osv.dev/vulnerability/GHSA-r67m-m8c7-jp83 · Vendor Advisory
• https://github.com/fiveai/Cachet · Note
• https://github.com/fiveai/Cachet/releases/tag/v2.5.1 · Note
• https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83 · Note
• https://t.me/cvenotify/40286 · Telegram Post
• https://t.me/cvenotify/20292 · Telegram Post