CVE-2024-42733
Published: 07 March 2025
Summary
CVE-2024-42733 is a critical-severity Code Injection (CWE-94) vulnerability in Docmosis Tornado. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-42733 is a remote code execution vulnerability affecting Docmosis Tornado version 2.9.7 and earlier. The flaw, tracked under CWE-94, permits arbitrary code execution when an attacker supplies a crafted script through the UNC path input field. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction.
A remote attacker can send a malicious UNC path value to the affected Tornado instance and achieve full arbitrary code execution on the server, resulting in complete compromise of confidentiality, integrity, and availability.
Public references consist of a GitHub issue in the tornado-docker repository and a proof-of-concept repository entry; neither source details official patches or mitigation steps beyond the version constraint noted in the CVE description.
EPSS for the vulnerability rose from lower values to a peak of 0.0693 on 2026-04-17 before receding to the current score of 0.0354, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54205
Vulnerability details
An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote code injection (CWE-94) in a public-facing Docmosis Tornado server allowing unauthenticated arbitrary code execution over the network, directly mapping to exploitation of public-facing applications for initial access and execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-42733 by requiring timely flaw remediation and patching of the vulnerable Docmosis Tornado software to eliminate the code injection vulnerability.
Prevents arbitrary code execution by enforcing validation of UNC path inputs to reject crafted malicious scripts.
Identifies and remediates the specific vulnerability in Docmosis Tornado versions 2.9.7 and earlier through regular scanning and patching processes.