CVE-2024-8517
Published: 06 September 2024
Summary
CVE-2024-8517 is a critical-severity External Control of File Name or Path (CWE-73) vulnerability in Spip Spip. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SPIP versions prior to 4.3.2, 4.2.16, and 4.1.18 are affected by a command injection vulnerability that permits arbitrary operating system command execution. The flaw resides in the software's handling of multipart file uploads and carries a CVSS 3.1 score of 9.8, with associated CWEs including CWE-73 and CWE-78.
A remote unauthenticated attacker can exploit the issue by submitting a crafted multipart file upload HTTP request, resulting in full command execution on the target system without requiring authentication or user interaction.
The SPIP project advisory directs users to upgrade to the fixed releases 4.3.2, 4.2.16, or 4.1.18. Multiple technical write-ups detail the upload-based attack vector and confirm the availability of patches through the referenced security announcement.
The CVE maintains an EPSS score of 0.9337.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49235
Vulnerability details
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Rejects externally supplied file or resource identifiers that fail validity checks.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.