PT-2024-29312 · Automation Anywhere · Automation Anywhere Automation 360

Published 2024-08-06 · Updated 2024-09-03 · CVE-2024-41226

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Automation Anywhere Automation 360 version 21094

Description A CSV injection issue allows attackers to execute arbitrary code via a crafted payload. The payload is injected in the HTTP response from the client-side. Note that Automation Anywhere disputes this report, arguing that the attacker executes everything from the client side and does not attack the Control Room, and that the server's security controls have no impact or role to play in this situation.

Recommendations For Automation Anywhere Automation 360 version 21094, consider implementing additional security controls to restrict the execution of arbitrary code via crafted payloads, as a temporary workaround until this issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2024-41226

Affected Products

Automation Anywhere Automation 360

References · 6

• 🔥 https://medium.com/%40aksalsalimi/cve-2024-41226-response-manipulation-led-to-csv-injection-9ae3182dcc02 · Exploit
• https://osv.dev/vulnerability/CVE-2024-41226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41226 · Security Note
• https://t.me/cvenotify/89941 · Telegram Post
• https://automationanywhere.com/products/automation-360 · Note
• https://t.me/cvedetector/2594 · Telegram Post