CVE-2022-24796 Remote Command Injection in RaspberryMatic
Remote unauthenticated attackers can execute arbitrary OS commands as root via shell metacharacters in the WebUI file upload mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24796?
CVE-2022-24796 is a critical command injection vulnerability in jens-maus RaspberryMatic, published on 31 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.
Weakness: CWE-78
Which versions are affected by CVE-2022-24796?
It affects 1 product.
Products include Raspberrymatic Raspberrymatic.
How do I fix CVE-2022-24796?
No fix has been published for CVE-2022-24796 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-24796 being exploited?
There is no known exploitation of CVE-2022-24796 in the wild and no public exploit code.
Other vulnerabilities in jens-maus RaspberryMatic
Sources
Also known as GHSA-g7vv-7rmf-mff7.