CVE-2024-23759
Published: 12 February 2024
Summary
CVE-2024-23759 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Gambio Gambio. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Deserialization of Untrusted Data affects the Gambio e-commerce platform through version 4.9.2.0. The flaw resides in the "search" parameter of the Parcelshopfinder/AddAddressBookEntry function and is tracked under CWE-502 and CWE-434, enabling attackers to supply malicious serialized data that results in arbitrary code execution.
Unauthenticated remote attackers can exploit the issue over the network without user interaction or credentials. Successful exploitation grants full control over the application process, allowing arbitrary code to be run with impacts to confidentiality, integrity, and availability as reflected in the CVSS 9.8 score.
The referenced security advisory at https://herolab.usd.de/security-advisories/usd-2023-0046/ addresses the vulnerability. Exploitation probability rose materially after disclosure, reaching a peak EPSS score of 0.7768 on 2025-01-22 before receding to the current value of 0.6711, indicating increased attacker interest in the months following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21212
Vulnerability details
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Validates or rejects untrusted serialized data before deserialization occurs.
Integrity verification of serialized information can detect tampering before deserialization occurs.