PT-2024-33263 · Unknown · Opencanary

0X0L0Rd · Published 2024-10-14 · Updated 2024-10-19 · CVE-2024-48911

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCanary versions prior to 0.9.4

Description OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon.

Recommendations For versions prior to 0.9.4, upgrade to 0.9.4 or higher to resolve the issue. As a temporary workaround, consider restricting access to the config file to prevent unprivileged users from modifying it until a patch is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-48911

GHSA-PF5V-PQFV-X8JJ

PYSEC-2024-248

Affected Products

Opencanary

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48911.json · Exploit
• https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj · Vendor Advisory
• https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049 · Patch
• https://osv.dev/vulnerability/PYSEC-2024-248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48911 · Security Note
• https://osv.dev/vulnerability/GHSA-pf5v-pqfv-x8jj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48911 · Vendor Advisory
• https://github.com/thinkst/opencanary/releases/tag/v0.9.4 · Note
• https://github.com/thinkst/opencanary · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/opencanary/PYSEC-2024-248.yaml · Note
• https://t.me/cvedetector/7861 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1845983878734901650 · Twitter Post
• https://twitter.com/cracbot/status/1847518136570097804 · Twitter Post
• https://twitter.com/CVEnew/status/1845930453292745024 · Twitter Post
• https://t.me/cvenotify/98013 · Telegram Post