CVE-2024-28754: RaspAP Denial of Service Vulnerability
Summary
CVE-2024-28754: raspap-webgui vulnerable to denial of service. Affects billz/raspap-webgui versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RaspAP, also known as raspap-webgui, is a popular open-source web interface for managing Wi-Fi access points and routers. It simplifies the process of configuring and managing wireless networks, making it accessible for users with varying levels of technical expertise. The application allows users to set up a hotspot, manage connected devices, and monitor network performance. However, a vulnerability in versions prior to 3.1.0 exposes the application to potential denial of service attacks, which can lead to the device becoming unresponsive or 'bricked'.
Vulnerability Detail
The vulnerability identified as CVE-2024-28754 allows remote attackers to exploit RaspAP through crafted requests, resulting in a persistent denial of service. This means that an attacker can send specially designed requests that cause the application to crash or become unresponsive, effectively 'bricking' the device. The issue arises from inadequate input validation, which fails to handle malicious requests appropriately. The severity of this vulnerability is rated high, with a CVSS score of 7.5, indicating a significant risk to users who have not updated to the patched version.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
composer require billz/raspap-webgui:3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the RaspAP interface by implementing firewall rules to limit incoming requests from untrusted sources. This can help prevent unauthorized access while waiting for the update to be applied. For example, you can use the following command to block all incoming traffic except from trusted IP addresses: `
iptables -A INPUT -s <trusted_ip> -j ACCEPT` followed by `iptables -A INPUT -j DROP`.
Conclusion
The CVE-2024-28754 vulnerability in RaspAP poses a significant risk, allowing remote attackers to cause denial of service. Users are strongly advised to update to version 3.1.0 or later to mitigate this risk. Implementing temporary workarounds can help protect systems until the update is applied.
See every vulnerability recorded for billz/raspap-webgui →
FAQ
RaspAP is an open-source web interface that simplifies the management of Wi-Fi access points and routers, allowing users to easily configure and monitor their networks.
CVE-2024-28754 is a vulnerability in RaspAP that allows remote attackers to send crafted requests, leading to a denial of service condition.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider implementing firewall rules to restrict access to the RaspAP interface as a temporary measure.
The CVSS score for CVE-2024-28754 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for billz/raspap-webgui.
