CVE-2024-3798 Insecure handling of GET argument in Phoniebox
An attacker can exploit insecure GET parameter handling to trigger SSRF, leading to command execution, XSS, or CSRF on Phoniebox devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-3798?
CVE-2024-3798 is a high-severity server-side request forgery vulnerability in Phoniebox, published on 10 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause one of the following (depending on the chosen payload): shell command execution, reflected XSS or cross-site request forgery.
This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.
Which versions are affected by CVE-2024-3798?
How do I fix CVE-2024-3798?
No fix has been published for CVE-2024-3798 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-3798 being exploited?
There is no known exploitation of CVE-2024-3798 in the wild and no public exploit code.
Sources
Also known as GHSA-954r-8vpp-vj52.