CVE-2024-42360 Command Injection in sequenceserver
Attackers can inject and execute arbitrary shell commands via unsanitized HTTP endpoints in SequenceServer, requiring an upgrade to secure the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42360?
CVE-2024-42360 is a critical command injection vulnerability in wurmlab sequenceserver, published on 14 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.
Weakness: CWE-77
Which versions are affected by CVE-2024-42360?
2 open source packages ship an affected version, including sequenceserver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sequenceserver RubyGems | All versions | 3.1.2 |
sequenceserver RubyGems | All versions | 3.1.2 |
Products include Wurmlab Sequenceserver.
How do I fix CVE-2024-42360?
Upgrade sequenceserver to 3.1.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-42360 being exploited?
There is no known exploitation of CVE-2024-42360 in the wild and no public exploit code.
Sources
Also known as GHSA-qv32-5wm2-p32h.