PT-2024-35402 · Projectdiscovery · Projectdiscovery Interactsh

Daniel Wu + 1 · Published 2024-06-05 · Updated 2024-06-14 · CVE-2024-5262

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectDiscovery Interactsh (affected versions not specified)

Description The issue allows remote attackers to read and write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login. This is due to a Files or Directories Accessible to External Parties vulnerability in the smb server of ProjectDiscovery Interactsh.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2024-5262

GHSA-Q5MG-PC7R-R8CR

GO-2024-2907

Affected Products

Projectdiscovery Interactsh

References · 12

• https://github.com/projectdiscovery/interactsh/pull/874 · Patch
• https://osv.dev/vulnerability/GHSA-q5mg-pc7r-r8cr · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2907 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5262 · Security Note
• https://github.com/projectdiscovery/interactsh/commit/6a0cb98b16636a98712729f3d23e34d8bf7260e7 · Note
• https://github.com/projectdiscovery/interactsh · Note
• https://t.me/cvenotify/82853 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-2907 · Note
• https://github.com/advisories/GHSA-q5mg-pc7r-r8cr · Note
• https://zuso.ai/advisory/za-2024-01 · Note
• https://t.me/cvenotify/82024 · Telegram Post