CVE-2024-39914
Published: 12 July 2024
Summary
CVE-2024-39914 is a critical-severity Command Injection (CWE-77) vulnerability in Fogproject Fogproject. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
FOG, a cloning/imaging/rescue suite and inventory management system, contains a command injection vulnerability in versions prior to 1.5.10.34. The flaw is located in packages/web/lib/fog/reportmaker.class.php and is reachable through the filename parameter supplied to the /fog/management/export.php endpoint, corresponding to CWE-77.
An unauthenticated remote attacker can supply a crafted filename value to execute arbitrary operating-system commands on the server. With a CVSS score of 9.8, successful exploitation grants complete control over confidentiality, integrity, and availability of the affected system.
The issue is resolved in release 1.5.10.34, as documented in the project’s GitHub security advisory GHSA-7h44-6vq6-cq8j and the associated commit that patches reportmaker.class.php. The current EPSS score of 0.9356 indicates sustained high exploitation probability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38296
Vulnerability details
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.