PT-2025-17297 · Croogo · Croogo

Published 2025-04-18 · Updated 2025-05-28 · CVE-2024-29643

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions croogo version 3.0.2

Description The issue allows an attacker to perform Host header injection via the feed.rss component.

Recommendations For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available. Restrict access to this component to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-74

CWE-444

Related Identifiers

CVE-2024-29643

GHSA-847X-X4JG-6GF4

Affected Products

Croogo

References · 8

• 🔥 https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-29643 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-847x-x4jg-6gf4 · Vendor Advisory
• https://github.com/croogo/croogo/issues/1005 · Note
• https://github.com/croogo/croogo · Note
• https://t.me/cvenotify/123880 · Telegram Post
• https://twitter.com/CVEnew/status/1913312983331311804 · Twitter Post