CVE-2018-14009 Codiad remote code execution vulnerability

What is CVE-2018-14009?

CVE-2018-14009 is a critical code injection vulnerability in n/a, published on 12 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.

Weakness: CWE-20

Which versions are affected by CVE-2018-14009?

2 open source packages ship an affected version, including codiad/codiad. It affects 1 product.

Products include Codiad Codiad.

How do I fix CVE-2018-14009?

No fix has been published for CVE-2018-14009 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-14009 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-14009 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2019-19208 Code injection in codiad Critical 9.8
• CVE-2017-11366 Codiad Vulnerable to Shell Command Injection Critical 9.8
• CVE-2020-14043 Codiad CSRF Vulnerability High 8.8
• CVE-2020-23355 Codiad Vulnerable to PHP Magic Hash Vulnerability High 7.5
• CVE-2017-1000125 File upload in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-584h-jhxh-pxp2.