CVE-2024-5262 ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties
Remote attackers can read or write arbitrary files via anonymous login in the Interactsh server's SMB component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5262?
CVE-2024-5262 is a critical path traversal vulnerability in ProjectDiscovery Interactsh, published on 5 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login.
Weakness: CWE-552
Which versions are affected by CVE-2024-5262?
3 open source packages ship an affected version, including github.com/projectdiscovery/interactsh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectdiscovery/interactsh Go | All versions | 1.2.0 |
github.com/projectdiscovery/interactsh Go | All versions | 1.2.0 |
github.com/projectdiscovery/interactsh Go | All versions | 1.2.0 |
Products include Projectdiscovery Interactsh.
How do I fix CVE-2024-5262?
Upgrade github.com/projectdiscovery/interactsh to 1.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-5262 being exploited?
There is no known exploitation of CVE-2024-5262 in the wild and no public exploit code.
Other vulnerabilities in ProjectDiscovery Interactsh
Sources
Also known as GHSA-q5mg-pc7r-r8cr, GO-2024-2907.