CVE-2024-24565 CrateDB database has an arbitrary file read vulnerability
Authenticated attackers can exploit the COPY FROM function to read arbitrary files from the server, leading to information leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-24565?
CVE-2024-24565 is a medium-severity path traversal vulnerability in crate, published on 30 Jan 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.
Weakness: CWE-22
Which versions are affected by CVE-2024-24565?
8 open source packages ship an affected version, including io.crate:crate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.crate:crate Maven | All versions | 5.3.9 |
io.crate:crate Maven | All versions | 5.3.9 |
io.crate:crate Maven | From 5.4.0 | 5.4.8 |
io.crate:crate Maven | From 5.4.0 | 5.4.8 |
io.crate:crate Maven | From 5.5.0 | 5.5.4 |
io.crate:crate Maven | From 5.5.0 | 5.5.4 |
2 more packages
io.crate:crate Maven | From 5.6.0 | 5.6.1 |
io.crate:crate Maven | From 5.6.0 | 5.6.1 |
Products include Cratedb Cratedb.
How do I fix CVE-2024-24565?
Upgrade io.crate:crate to a fixed version for your release line: 5.3.9, 5.4.8, 5.5.4 or 5.6.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-24565 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24565 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in crate
Sources
Also known as GHSA-475g-vj6c-xf96.