PT-2024-33316 · Snipe-It · Snipe-It

Mickaël Benassouli + 1 · Published 2024-10-10 · Updated 2025-01-07 · CVE-2024-48987

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 7.0.10

Description The issue allows remote code execution when an attacker knows the APP KEY, which is associated with cookie serialization. This is worsened by the availability of .env files from the product's repository that contain default APP KEY values.

Recommendations For versions prior to 7.0.10, update to version 7.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the APP KEY and ensuring that .env files do not contain default values.

Exploit

Fix

Weakness Enumeration

CWE-1393

Related Identifiers

CVE-2024-48987

GHSA-57QH-VMJR-5JXG

Affected Products

Snipe-It

References · 9

• 🔥 https://synacktiv.com/advisories/snipe-it-unauthenticated-remote-command-execution-when-appkey-known · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48987 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57qh-vmjr-5jxg · Vendor Advisory
• https://github.com/snipe/snipe-it/releases/tag/v7.0.10 · Note
• https://github.com/snipe/snipe-it · Note
• https://twitter.com/CVEnew/status/1844601886470447151 · Twitter Post
• https://snipe-it.readme.io/docs/key-rotation · Note
• https://twitter.com/Synacktiv/status/1867587281311191468 · Twitter Post