CVE-2024-32487 Command injection in n/a

High 8.6 Published 13 Apr 2024 Updated 2 Aug 2024

Attackers can execute arbitrary OS commands via malicious filenames in less, requiring LESSOPEN which is often default.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-32487?

CVE-2024-32487 is a high-severity command injection vulnerability in Debian Debian Linux, published on 13 Apr 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

Weakness: CWE-96

Which versions are affected by CVE-2024-32487?

It affects 5 products.

Linux distribution packages (40)

`less` AlmaLinux:9	All versions	`590-4.el9_4`
`less` Red Hat:enterprise_linux:7::client	All versions	`0:458-10.el7_9`
`less-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:458-10.el7_9`
`less` Red Hat:enterprise_linux:7::server	All versions	`0:458-10.el7_9`
`less-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:458-10.el7_9`
`less` Red Hat:enterprise_linux:7::workstation	All versions	`0:458-10.el7_9`
`less-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:458-10.el7_9`
`less` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-4.el9_4`
`less-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-4.el9_4`
`less-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:590-4.el9_4`
`less` Red Hat:rhel_aus:8.2::baseos	All versions	`0:530-2.el8_2`
`less-debuginfo` Red Hat:rhel_aus:8.2::baseos	All versions	`0:530-2.el8_2`
`less-debugsource` Red Hat:rhel_aus:8.2::baseos	All versions	`0:530-2.el8_2`
`less` Red Hat:rhel_aus:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debuginfo` Red Hat:rhel_aus:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debugsource` Red Hat:rhel_aus:8.4::baseos	All versions	`0:530-2.el8_4`
`less` Red Hat:rhel_aus:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debugsource` Red Hat:rhel_aus:8.6::baseos	All versions	`0:530-3.el8_6`
`less` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debuginfo` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debugsource` Red Hat:rhel_e4s:8.4::baseos	All versions	`0:530-2.el8_4`
`less` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debuginfo` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debugsource` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:530-3.el8_6`
`less` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:590-2.el9_0`
`less-debuginfo` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:590-2.el9_0`
`less-debugsource` Red Hat:rhel_e4s:9.0::baseos	All versions	`0:590-2.el9_0`
`less` Red Hat:rhel_eus:8.8::baseos	All versions	`0:530-3.el8_8`
`less-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:530-3.el8_8`
`less-debugsource` Red Hat:rhel_eus:8.8::baseos	All versions	`0:530-3.el8_8`
`less` Red Hat:rhel_eus:9.2::baseos	All versions	`0:590-3.el9_2`
`less-debuginfo` Red Hat:rhel_eus:9.2::baseos	All versions	`0:590-3.el9_2`
`less-debugsource` Red Hat:rhel_eus:9.2::baseos	All versions	`0:590-3.el9_2`
`less` Red Hat:rhel_tus:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debuginfo` Red Hat:rhel_tus:8.4::baseos	All versions	`0:530-2.el8_4`
`less-debugsource` Red Hat:rhel_tus:8.4::baseos	All versions	`0:530-2.el8_4`
`less` Red Hat:rhel_tus:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debuginfo` Red Hat:rhel_tus:8.6::baseos	All versions	`0:530-3.el8_6`
`less-debugsource` Red Hat:rhel_tus:8.6::baseos	All versions	`0:530-3.el8_6`

Products include Debian Debian Linux, Greenwoodsoftware Less, Netapp Bootstrap Os, Netapp Hci Storage Nodes, Netapp Solidfire.

How do I fix CVE-2024-32487?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-32487 being exploited?

There is no known exploitation of CVE-2024-32487 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALSA-2024:3513, AZL-39914, AZL-39933, CLSA-2024-1715672446, CLSA-2024-1715672666, CLSA-2024-1715673429 and 32 more.