CVE-2024-37779
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
WoodWing Elvis DAM v6.98.1 contains an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. This vulnerability is associated with CWE-94 (Improper Control of Generation of Code) and CWE-75 (Failure to Sanitize Special Elements into a Different Plane).
Impact
This vulnerability allows an authenticated attacker to execute arbitrary commands remotely on the affected system. Given the CVSS v3.1 base score of 8.8 (High severity), the impact is significant. The vulnerability affects all three main security aspects - confidentiality, integrity, and availability - with a high impact rating for each. Attackers can potentially access sensitive information, modify system data, or disrupt system operations. The attack vector is network-based, requires low attack complexity, and no user interaction, making it relatively easy to exploit.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
As of the provided information, there is no mention of an available patch. The security team should monitor for updates from WoodWing for a patched version of Elvis DAM that addresses this vulnerability.
Mitigation
While waiting for an official patch, the security team should consider the following mitigation strategies: 1. Limit network access to the WoodWing Elvis DAM system, especially from untrusted networks. 2. Implement strong authentication mechanisms and review user privileges to ensure the principle of least privilege. 3. Monitor and audit all activities related to the Apache Ant script functionality within WoodWing Elvis DAM. 4. If possible, disable or restrict access to the Apache Ant script functionality until a patch is available. 5. Implement network segmentation to isolate the affected systems. 6. Regularly monitor for any suspicious activities or unauthorized changes in the system. 7. Keep all related systems and software up-to-date with the latest security patches. 8. Consider implementing additional security controls such as Web Application Firewalls (WAF) to help detect and prevent potential exploitation attempts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-37779
Feedly found the first article mentioning CVE-2024-37779. See article
A CVSS base score of 5.7 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 9.6%)
A CVSS base score of 8.8 has been assigned.