PT-2024-31513 · Byob · Byob

Published 2024-09-14 · Updated 2026-05-10 · CVE-2024-45257

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BYOB (affected versions not specified)

Description The issue concerns unauthenticated remote code execution on BYOB via arbitrary file write. A research paper was written on this topic, but there was an incident involving the theft of this research by two researchers from Trellix, who initially claimed it as their own before adding credits after being caught.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-45257

Affected Products

Byob

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/byob_unauth_rce.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45257 · Security Note
• https://github.com/malwaredllc/byob · Note
• https://twitter.com/VulmonFeeds/status/1846314292896837710 · Twitter Post
• https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/byob_unauth_rce.rb · Note
• https://t.me/cveNotify/162746 · Telegram Post
• https://t.me/CVEtracker/53083 · Telegram Post
• https://twitter.com/vxunderground/status/1834991521197645977 · Twitter Post
• https://twitter.com/CVEnew/status/2053559163679130056 · Twitter Post
• https://twitter.com/_chebuya/status/1835015681647296751 · Twitter Post