PT-2024-27871 · Phoniebox · Phoniebox

Lukigruszka · Published 2024-07-10 · Updated 2024-07-12 · CVE-2024-3799

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Phoniebox versions prior to 3.0

Description The issue is related to insecure handling of the body parameter in POST header requests sent to an instance of the Phoniebox open-source project. This allows an attacker to create a website that, when visited by a user, will send malicious requests to multiple hosts on the local network, potentially causing shell command execution.

Recommendations For Phoniebox versions prior to 3.0, update to version 3.0 or higher to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable POST endpoint until a patch is available. Avoid using the body parameter in POST requests to the Phoniebox instance until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-3799

Affected Products

Phoniebox

References · 9

• https://osv.dev/vulnerability/CVE-2024-3799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3799 · Security Note
• https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2342 · Note
• https://cert.pl/en/posts/2024/07/CVE-2024-3798 · Note
• https://t.me/cvedetector/535 · Telegram Post
• https://t.me/cvenotify/85989 · Telegram Post
• https://t.me/cvenotify/85676 · Telegram Post
• https://cert.pl/posts/2024/07/CVE-2024-3798 · Note
• https://twitter.com/CVEnew/status/1811062883771449549 · Twitter Post