CVE-2024-41997

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41997
An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the `warp://action/docker/open_subshell` intent that when clicked by the victim results in command execution on the victim's machine.

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://docs.warp.dev/features/integrations-and-plugins#docker
https://docs.warp.dev/getting-started/changelog#id-2024.07.18-v0.2024.07.16.08.02
https://gist.github.com/bhyh/d1ee7a825fce283bf8acbdb42c8a7832
https://github.com/warpdotdev/warp
Configurations

No configuration.

History

16 Oct 2024, 20:35

Type Values Removed Values Added
CWE CWE-94
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.6

15 Oct 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en la versión de Warp Terminal anterior a 2024.07.18 (v0.2024.07.16.08.02). Existe una vulnerabilidad de inyección de comandos en la funcionalidad de integración de Docker. Un atacante puede crear un hipervínculo especialmente manipulado utilizando la intención `warp://action/docker/open_subshell` que, cuando la víctima hace clic en él, da como resultado la ejecución del comando en la máquina de la víctima.

14 Oct 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-14 16:15

Updated : 2024-10-16 20:35

NVD link : CVE-2024-41997

Mitre link : CVE-2024-41997

CVE.ORG link : CVE-2024-41997

JSON object : View

Products Affected

No product.

CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')