CVE-2024-57609
Published: 06 February 2025
Summary
CVE-2024-57609 is a high-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the insufficient sanitization of the redirect_path parameter by requiring validation of all information inputs to prevent code injection.
Addresses the vulnerability by requiring timely flaw remediation through upgrading Pygwalker to version 0.4.9.9 or later where the issue is fixed.
Provides additional protection by restricting the redirect_path parameter to approved safe values, limiting opportunities for code injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-94 code injection in network-exposed login redirect enables remote arbitrary code execution (T1190) via Python (T1059.006).
NVD Description
An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.
Deeper analysisAI
CVE-2024-57609 is a code injection vulnerability (CWE-94) affecting Kanaries Inc's Pygwalker library in versions prior to 0.4.9.9. The flaw resides in the login redirection function, where the redirect_path parameter is insufficiently sanitized, enabling a remote attacker to obtain sensitive information and execute arbitrary code. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and significant confidentiality impact.
A remote attacker can exploit this vulnerability without authentication by crafting a malicious request targeting the redirect_path parameter during login redirection. Successful exploitation allows the attacker to steal sensitive data from the affected application and execute arbitrary code within the context of the Pygwalker process, potentially leading to full server compromise depending on the deployment environment.
Mitigation involves upgrading to Pygwalker version 0.4.9.9 or later, as indicated by the vulnerability description specifying affected versions. Additional details on exploitation, proof-of-concept, and remediation are available in the advisory at https://github.com/nca785/CVE-2024-57609/.
Details
- CWE(s)