GHSA-c2p2-hgjg-9r3f Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header
Remote attackers can execute arbitrary code on web-accessible Crayfish hypercube installations via the X-Islandora-Args header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-c2p2-hgjg-9r3f?
GHSA-c2p2-hgjg-9r3f is a command injection vulnerability in islandora/crayfish, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
What kind of vulnerability is it? Who is impacted?
Remote code execution is possible in web-accessible installations of hypercube.
Patches
Has the problem been patched? What versions should users upgrade to?
Not yet, though no patch is neccessary if your installation of the microservices is behind a firewall. See below.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
The exploit requires making a request against Hypercube's endpoints; therefore, the ability to make use of the exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Hypercube. Furthermore, if you've used any of the official installation methods, your Crayfish will be behind a firewall and there is no work neccessary.
The webserver might be made to validate the structure of headers passed, but that would only be neccessary if you publicly exposed the endpoint. Standard security practices should be applied.
References
Are there any links users can visit to find out more?
- XBOW-024-074
Which versions are affected by GHSA-c2p2-hgjg-9r3f?
2 open source packages ship an affected version, including islandora/crayfish.
| Package | Affected | Fixed in |
|---|---|---|
islandora/crayfish Packagist | All versions to 4.0.0 | None |
islandora/crayfish Packagist | All versions to 4.0.0 | None |
How do I fix GHSA-c2p2-hgjg-9r3f?
No fix has been published for GHSA-c2p2-hgjg-9r3f yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-c2p2-hgjg-9r3f being exploited?
There is no known exploitation of GHSA-c2p2-hgjg-9r3f in the wild and no public exploit code.