CVE-2024-27292 Docassemble unauthorized access through URL manipulation
Attackers can gain unauthorized access to system information via URL manipulation in Docassemble, requiring a patch to secure data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27292?
CVE-2024-27292 is a high-severity missing authorization vulnerability in jhpyle docassemble, published on 29 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
Weakness: CWE-706
Which versions are affected by CVE-2024-27292?
6 open source packages ship an affected version, including docassemble-base, docassemble-webapp and docassemble.base. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
docassemble-base PyPI | From 1.4.53 | 1.4.97 |
docassemble-base PyPI | From 1.4.53 | 1.4.97 |
docassemble-webapp PyPI | From 1.4.53 | 1.4.97 |
docassemble-webapp PyPI | From 1.4.53 | 1.4.97 |
docassemble.base PyPI | From 1.4.53 | 1.4.97 |
docassemble.webapp PyPI | From 1.4.53 | 1.4.97 |
Products include Jhpyle Docassemble.
How do I fix CVE-2024-27292?
Upgrade docassemble-base to 1.4.97 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-27292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27292 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in jhpyle docassemble
Sources
Also known as GHSA-jq57-3w7p-vwvv, PYSEC-2026-1309, PYSEC-2026-2453.