CVE-2024-27448
Published: 05 April 2024
Summary
CVE-2024-27448 is a critical-severity CSRF (CWE-352) vulnerability in Com (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
MailDev versions 2 through 2.1.0 contain a remote code execution vulnerability in which a crafted Content-ID header on an email attachment causes lib/mailserver.js to write attacker-controlled code into the routes.js file. The flaw is tracked as CVE-2024-27448, carries a CVSS 3.1 score of 9.1, and is associated with CWE-352.
An unauthenticated attacker with network access can send a single malicious email containing the malicious attachment; successful exploitation grants arbitrary code execution on the MailDev instance without user interaction, resulting in full compromise of confidentiality and integrity on the affected system.
Public references point to the project’s GitHub releases and issue tracker for available updates, along with independent exploit code and technical write-ups that document the injection path.
EPSS for the CVE rose from a low baseline to a peak of 0.1408, indicating measurable post-disclosure exploitation interest that warrants renewed attention from operators still running the affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1309
Vulnerability details
MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.