CVE-2024-49380 Plenti arbitrary file write vulnerability
An attacker can write arbitrary files via the /postLocal endpoint when a user serves their website, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49380?
CVE-2024-49380 is a high-severity path traversal vulnerability in plentico plenti, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.
Which versions are affected by CVE-2024-49380?
3 open source packages ship an affected version, including github.com/plentico/plenti. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/plentico/plenti Go | All versions | 0.7.2 |
github.com/plentico/plenti Go | All versions | 0.7.2 |
github.com/plentico/plenti Go | All versions | 0.7.2 |
Products include Plenti Plenti.
How do I fix CVE-2024-49380?
Upgrade github.com/plentico/plenti to 0.7.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-49380 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49380 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in plentico plenti
Sources
Also known as GHSA-2p96-p7qh-4rgr, GO-2024-3213.