CVE-2024-45720 Apache Subversion: Command line argument injection on Windows platforms
Attackers can inject command line arguments on Windows to execute arbitrary programs via crafted strings in Subversion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-45720?
CVE-2024-45720 is a high-severity command injection vulnerability in Apache Subversion, published on 9 Oct 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed.
All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.
Subversion is not affected on UNIX-like platforms.
Weakness: CWE-78
Which versions are affected by CVE-2024-45720?
1 open source package ship an affected version, including subversion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
subversion Bitnami | From 1.0.0 | 1.14.4 |
Products include Apache Subversion.
How do I fix CVE-2024-45720?
Upgrade subversion to 1.14.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-45720 being exploited?
There is no known exploitation of CVE-2024-45720 in the wild and no public exploit code.
Other vulnerabilities in Apache Subversion
- CVE-2017-9800 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha
- CVE-2013-4246 Denial of service in n/a
- CVE-2015-5259 Integer overflow in n/a
- CVE-2015-0202 Denial of service in n/a
- CVE-2013-2112 Denial of service in n/a
Sources
Also known as ALPINE-CVE-2024-45720, BELL-CVE-2024-45720, BIT-subversion-2024-45720, GHSA-86vm-fj76-qh69.