PT-2024-22271 · Unknown · Peering Manager

Ntc-Swiss-Team · Published 2024-03-12 · Updated 2024-03-13 · CVE-2024-28114

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Peering Manager versions <=1.8.2

Description Peering Manager is a BGP session management tool. There is a Server Side Template Injection issue that leads to Remote Code Execution, allowing arbitrary commands to be executed on the operating system running Peering Manager.

Recommendations For Peering Manager versions <=1.8.2, upgrade to version 1.8.3 to address the issue. At the moment, there are no known workarounds for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-28114

GHSA-Q37X-QFRX-JCV6

Affected Products

Peering Manager

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28114.json · Exploit
• https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6 · Vendor Advisory
• https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-28114 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28114 · Vendor Advisory
• https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_Injection · Note
• https://twitter.com/CVEnew/status/1767645976745988384 · Twitter Post
• https://owasp.org/www-community/attacks/Command_Injection · Note
• https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-python · Note