PT-2024-27960 · Airbyte · Airbyte

Mikecole-Mg · Published 2024-07-09 · Updated 2024-07-09 · CVE-2024-38363

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airbyte versions prior to 0.62.2

Description The Airbyte connection builder docker image is vulnerable to remote code execution (RCE) via server-side template injection (SSTI), allowing an authenticated remote attacker to execute arbitrary code on the server as the web server user. This vulnerability could expose sensitive information, such as credentials, if a user tests a new connector on a compromised instance. However, the connection builder does not have access to any data processes.

Recommendations For versions prior to 0.62.2, update to version 0.62.2 to resolve the issue. As a temporary workaround, consider restricting access to the connection builder to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2024-38363

GHSA-4J3C-FGVX-XGQQ

Affected Products

Airbyte

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38363.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-38363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38363 · Security Note
• https://github.com/airbytehq/airbyte/security/advisories/GHSA-4j3c-fgvx-xgqq · Note
• https://twitter.com/CveFindCom/status/1810796594326798731 · Twitter Post
• https://twitter.com/CVEnew/status/1810700146709012545 · Twitter Post
• https://t.me/cvedetector/371 · Telegram Post