PT-2024-21800 · Unknown · Docassemble

Richighimi · Published 2024-02-29 · Updated 2025-09-02 · CVE-2024-27292

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docassemble versions 1.4.53 through 1.4.96

Description The issue allows attackers to gain unauthorized access to information on the system through URL manipulation. It is an unauthenticated path traversal flaw that exposes sensitive files and secrets, leading to privilege escalation and template injection, enabling remote code execution. The vulnerability affects Docassemble, an expert system for guided interviews and document assembly.

Recommendations For versions 1.4.53 through 1.4.96, update to version 1.4.97 of the master branch to resolve the issue. If upgrading is not possible, manually apply the changes of the patch and restart the server. As a temporary workaround, consider restricting access to sensitive files and secrets to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2024-27292

GHSA-JQ57-3W7P-VWVV

Affected Products

Docassemble

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27292.json · Exploit
• 🔥 https://github.com/th3gokul/CVE-2024-27292 · Exploit
• https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27292 · Security Note
• https://osv.dev/vulnerability/GHSA-jq57-3w7p-vwvv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27292 · Vendor Advisory
• https://github.com/jhpyle/docassemble · Note
• https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv · Note
• https://t.me/rnetsec/20521 · Telegram Post
• https://t.me/cybersecuritytechnologies/10791 · Telegram Post
• https://t.me/cveNotify/134072 · Telegram Post
• https://twitter.com/Crowd_Security/status/1906990076992667884 · Twitter Post
• https://twitter.com/cracbot/status/1771321504002716070 · Twitter Post
• https://t.me/defcon_news/124264 · Telegram Post
• https://twitter.com/Crowd_Security/status/1906990074958401601 · Twitter Post