CVE-2024-42166

The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

History

29 Aug 2024, 15:23

Type Values Removed Values Added
CPE cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 9.1
v2 : unknown
v3 : 7.2
Summary
  • (es) La función "generate_app_certificates" en lib/app_certificates.js de FIWARE Keyrock &lt;= 8.4 no neutraliza correctamente los elementos especiales utilizados en un comando del sistema operativo. Esto permite a un usuario autenticado con permisos crear aplicaciones para ejecutar comandos creando una aplicación con un nombre malicioso.
First Time Fiware
Fiware keyrock
References () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories - () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories - Exploit, Third Party Advisory

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-12 13:38

Updated : 2024-08-29 15:23


NVD link : CVE-2024-42166

Mitre link : CVE-2024-42166

CVE.ORG link : CVE-2024-42166


JSON object : View

Products Affected

fiware

  • keyrock
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')