PT-2024-20680 · Raspap · Raspap

Torada · Published 2024-03-15 · Updated 2025-04-09 · CVE-2024-2497

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui version 3.0.9

Description A critical issue affects the processing of the file includes/provider.php in the HTTP POST Request Handler component. The manipulation of the country argument leads to code injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For RaspAP raspap-webgui version 3.0.9, consider disabling the includes/provider.php file or restricting access to the HTTP POST Request Handler component until a patch is available. Avoid using the country argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-2497

GHSA-99WG-VMVQ-2CP5

Affected Products

Raspap

References · 11

• 🔥 https://toradah.notion.site/Code-Injection-Leading-to-Remote-Code-Execution-RCE-in-RaspAP-Web-GUI-d321e1a416694520bec7099253c65060?pvs=4 · Exploit
• https://osv.dev/vulnerability/GHSA-99wg-vmvq-2cp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2497 · Security Note
• https://github.com/RaspAP/raspap-webgui · Note
• https://vuldb.com/?id.256919 · Note
• https://twitter.com/CVEnew/status/1768688489615479132 · Twitter Post
• https://vuldb.com/?ctiid.256919 · Note
• https://t.me/cvenotify/74084 · Telegram Post
• https://t.me/cvenotify/73981 · Telegram Post
• https://t.me/cvenotify/118462 · Telegram Post