CVE-2024-24550
Published: 24 June 2024
Summary
CVE-2024-24550 is a high-severity Command Injection (CWE-77) vulnerability in Bludit Bludit. Its CVSS base score is 8.9 (High).
Operationally, ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21968
Vulnerability details
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of…
more
file uploads, enabling malicious actors to upload and execute PHP files.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Validates or rejects untrusted serialized data before deserialization occurs.
Integrity verification of serialized information can detect tampering before deserialization occurs.