CVE-2024-41961 Elektra vulnerable to remote code execution in universal search
An authenticated user can execute arbitrary Ruby code via crafted search terms in the Elektra OpenStack dashboard.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41961?
CVE-2024-41961 is a critical code injection vulnerability in sapcc elektra, published on 1 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.
Weakness: CWE-94
Which versions are affected by CVE-2024-41961?
How do I fix CVE-2024-41961?
No fix has been published for CVE-2024-41961 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-41961 being exploited?
There is no known exploitation of CVE-2024-41961 in the wild and no public exploit code.
Sources
Also known as GHSA-6j2h-486h-487q.