CVE-2024-39914

CRITICALNuclei

FOG has a command injection in /fog/management/export.php?filename=

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-39914 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 5, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 12, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

FOG

Browse FOGProject / FOG
VulnCheckVersion data not supplied

fogproject

Browse FOGProject / fogproject

Default status: unknown

CVE List< 1.5.10.34affected
Before 1.5.10.34affected

Proofs of concept

1

Repository PoCs

GitHub9874621368/FOG-ProjectRepository PoCby 98746213680Not analyzed2 files

2.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALFOG Project < 1.5.10.34 - Remote Command ExecutionCVSS 9.8

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php.

Impact

Unauthenticated attackers can exploit command injection to achieve remote code execution on the FOG server.

Remediation

Update FOG Project to version 1.5.10.34 or later.

WeaknessesCWE-77
Authorss4e-io
Template tagscvecve2024rcefogvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FOFA: icon_hash="-1952619005"
https://nvd.nist.gov/vuln/detail/CVE-2024-39914 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39914 https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j https://blog.csdn.net/qq_39894062/article/details/140550009

Source: ProjectDiscovery

References

2