CVE-2024-3955 Arbitrary code execution in CraftBeerPi 4
CraftBeerPi 4 allows arbitrary code execution via the logtime parameter in the downloadlog function due to lack of input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3955?
CVE-2024-3955 is a critical command injection vulnerability in CraftBeerPi 4, published on 2 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).
Weakness: CWE-94
Which versions are affected by CVE-2024-3955?
3 open source packages ship an affected version, including cbpi4.
| Package | Affected | Fixed in |
|---|---|---|
cbpi4 PyPI | From 4.0.0.58 | 4.4.1.a1 |
cbpi4 PyPI | From 4.0.0.58 | 4.4.1.a1 |
cbpi4 PyPI | From 4.0.0.58 | 4.4.1.a1 |
How do I fix CVE-2024-3955?
Upgrade cbpi4 to 4.4.1.a1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-3955 being exploited?
There is no known exploitation of CVE-2024-3955 in the wild and no public exploit code.
Sources
Also known as GHSA-4f92-w438-f484, PYSEC-2026-308.