CVE-2024-3799 Shell command injection in Phoniebox
An attacker can execute arbitrary shell commands on Phoniebox devices by tricking a user into visiting a malicious website that sends crafted requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-3799?
CVE-2024-3799 is a high-severity command injection vulnerability in Phoniebox, published on 10 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause a shell command execution.
This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.
Weakness: CWE-78
Which versions are affected by CVE-2024-3799?
How do I fix CVE-2024-3799?
No fix has been published for CVE-2024-3799 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-3799 being exploited?
There is no known exploitation of CVE-2024-3799 in the wild and no public exploit code.
Sources
Also known as GHSA-98h6-g9rg-hxmr.