CVE-2024-57971
Published: 16 February 2025
Summary
CVE-2024-57971 is a critical-severity Resource Injection (CWE-99) vulnerability in Readthedocs (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of JNDI names input to DataSourceResource.java to ensure they begin with 'java:comp/env/jdbc/', preventing improper resource identifier handling.
Mandates enforcement of access authorizations for system resources, which this CVE bypasses through unvalidated JNDI lookups allowing access beyond intended data sources.
Requires timely identification, reporting, and correction of flaws like this JNDI validation failure, as fixed in KNOWAGE 8.1.30.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
JNDI injection flaw in public SpagoBI API endpoint directly enables remote exploitation of a server-side application (T1190).
NVD Description
DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
Deeper analysisAI
CVE-2024-57971 is a vulnerability in DataSourceResource.java within the SpagoBI API support of Knowage Server in KNOWAGE versions before 8.1.30. The flaw arises because the component fails to validate that JNDI names begin with "java:comp/env/jdbc/", allowing improper handling of resource identifiers (CWE-99). It has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact network-accessible exploitation.
A high-privileged remote attacker (PR:H) can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables high confidentiality, integrity, and availability impacts across a changed scope (S:C), potentially allowing the attacker to manipulate JNDI lookups beyond intended data source contexts.
Mitigation is addressed in KNOWAGE version 8.1.30, as detailed in the GitHub commit f7d0362f737e1b0db1cc9cc95b1236d62d83dd0c and the release comparison between v8.1.29 and v8.1.30. Security practitioners should upgrade to the patched version and review JNDI configurations in affected deployments. Additional details are available in the Knowage documentation at spagobi.readthedocs.io.
Details
- CWE(s)