CVE-2024-1651 Torrentpier 2.4.1 - RCE
Attackers can execute arbitrary commands on the server via insecure deserialization in Torrentpier.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1651?
CVE-2024-1651 is a critical unsafe deserialization vulnerability in Torrentpier, published on 19 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Torrentpier version 2.4.1 allows executing arbitrary commands on the server.
This is possible because the application is vulnerable to insecure deserialization.
Weakness: CWE-502
Which versions are affected by CVE-2024-1651?
2 open source packages ship an affected version, including torrentpier/torrentpier. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
torrentpier/torrentpier Packagist | All versions to 2.4.1 | None |
torrentpier/torrentpier Packagist | All versions to 2.4.1 | None |
Products include Torrentpier Torrentpier.
How do I fix CVE-2024-1651?
No fix has been published for CVE-2024-1651 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-1651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1651 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Torrentpier
Sources
Also known as GHSA-5rwm-2xw8-hh9p.