CVE-2024-3705 Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys

High 8.8 Published 12 Apr 2024 Updated 9 Aug 2024

Attackers can upload malicious files to OpenGnsys to execute arbitrary code via webshell injection due to missing file extension verification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3705?

CVE-2024-3705 is a high-severity vulnerability in OpenGnsys, published on 12 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unrestricted file upload vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to send a POST request to the endpoint '/opengnsys/images/M_Icons.php' modifying the file extension, due to lack of file extension verification, resulting in a webshell injection.

Weakness: CWE-434

Which versions are affected by CVE-2024-3705?

It affects 1 product.

Products include Opengnsys Opengnsys.

How do I fix CVE-2024-3705?

No fix has been published for CVE-2024-3705 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3705 being exploited?

There is no known exploitation of CVE-2024-3705 in the wild and no public exploit code.

Sources

Also known as GHSA-pjv5-66g3-7gqx.