CVE-2024-55963

Medium

Published: 26 March 2025

Published

26 March 2025

Modified

01 April 2025

KEV Added

—

Patch

—

CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.3723 97.2th percentile

Risk Priority 35 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55963 is a medium-severity Improper Access Control (CWE-284) vulnerability in Appsmith Appsmith. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations on APIs like the restart endpoint to prevent non-admin users from triggering server restarts.

AC-6 Least Privilege partial match

prevent

Implements least privilege to restrict restart API access to only super users, complementing enforcement checks.

SC-5 Denial-of-service Protection partial match

prevent

Protects against denial-of-service from repeated restart invocations by limiting their effects on system availability.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

The vulnerability allows low-privileged authenticated users to invoke the restart API, directly enabling denial of service by restarting the application server.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited…

to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.

Deeper analysisAI

CVE-2024-55963 affects Appsmith versions prior to 1.51 and involves incorrect access control checks (CWE-284) on the restart API endpoint. Non-administrative users can trigger this API, causing the Appsmith server to restart within its container. While the impact is confined to the Appsmith server itself, repeated invocations enable a denial-of-service condition.

The vulnerability has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating network accessibility, low attack complexity, and exploitation requiring only low privileges with no user interaction. An authenticated attacker with a standard user account can repeatedly call the restart API to disrupt service availability, though confidentiality and integrity are not impacted.

The official advisory from Appsmith, available at https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr, addresses mitigation. Organizations should upgrade to Appsmith 1.51 or later, which enforces proper super user permission checks on the restart API requests.