CVE-2024-24892 Unauthorized RCE in migration-tools
Attackers can execute arbitrary OS commands and elevate privileges via improper input handling in openEuler migration-tools.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-24892?
CVE-2024-24892 is a high-severity command injection vulnerability in openEuler migration-tools, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py.
This issue affects migration-tools: from 1.0.0 through 1.0.1.
Which versions are affected by CVE-2024-24892?
How do I fix CVE-2024-24892?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-24892 being exploited?
There is no known exploitation of CVE-2024-24892 in the wild and no public exploit code.
Sources
Also known as GHSA-fmvv-3w6j-94vx, OESA-2024-1275.