Exploitation Summary
CVE-2024-55963 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Nishanth Gaddam, superswan.
AI-analyzed exploit summary This exploit leverages a misconfigured PostgreSQL database in AppSmith versions prior to v1.52 to achieve unauthenticated remote code execution via the COPY FROM PROGRAM command. It automates user signup, login, workspace creation, and payload delivery.
Description
An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.
Exploits (2)
This exploit leverages a misconfigured PostgreSQL database in AppSmith versions prior to v1.52 to achieve unauthenticated remote code execution via the COPY FROM PROGRAM command. It automates user signup, login, workspace creation, and payload delivery.
This exploit leverages CVE-2024-55963 to achieve remote code execution (RCE) in Appsmith by creating a PostgreSQL datasource and executing arbitrary commands via a crafted SQL function. It handles authentication, workspace setup, and environment configuration to exploit the vulnerability.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H