Command Injection Vulnerability in aliyundrive-webdav
Summary
CVE-2024-29640: aliyundrive-webdav vulnerable to Command Injection. Affects aliyundrive-webdav versions < 2.3.3. No fix is published. How to fix ↓
Also tracked for
- aliyundrive-webdav · PyPI
The same CVE-2024-29640 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aliyundrive-webdav is a package available on crates.io and PyPI that provides webdav functionality for interacting with Aliyun Drive. It allows users to perform various operations such as uploading, downloading, and managing files on Aliyun Drive. However, versions up to 2.3.3 of aliyundrive-webdav are vulnerable to a command injection attack.
Vulnerability Detail
The vulnerability in aliyundrive-webdav arises from a lack of input validation in the action_query_qrcode component. An attacker can exploit this by crafting a malicious payload and sending it as the sid parameter. This can lead to the execution of arbitrary code on the server, potentially resulting in unauthorized access, data leakage, or further compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a patched version of aliyundrive-webdav to ensure the security of the system.
Conclusion
The command injection vulnerability in aliyundrive-webdav can be mitigated by updating to version 2.3.4 or a later version. It is recommended to promptly apply the patch to ensure the security of the system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aliyundrive-webdav →
FAQ
aliyundrive-webdav is a package that provides webdav functionality for interacting with Aliyun Drive, a cloud storage service.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a target system by injecting malicious input into a command execution context.
This vulnerability allows an attacker to execute arbitrary code on the server running aliyundrive-webdav, potentially leading to unauthorized access, data leakage, or further compromise of the system.
To fix this vulnerability, update aliyundrive-webdav to version 2.3.4 or a later version that includes the patch for this issue.
No, there is no known workaround for this vulnerability. It is crucial to update to a patched version of aliyundrive-webdav.
