CVE-2024-36528: nukeviet Deserialization of Untrusted Data vulnerability
Summary
CVE-2024-36528: nukeviet Deserialization of Untrusted Data vulnerability. Affects nukeviet/nukeviet versions < 4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nukeviet package, specifically versions 4.5 and earlier, as well as nukeviet-egov version 1.2.02 and earlier, is susceptible to a Deserialization vulnerability. This vulnerability can be exploited through the 'download.php' and 'upload.php' files located in the '/admin/extensions/' directory.
Vulnerability Detail
The Deserialization vulnerability in nukeviet allows for the execution of arbitrary code. Attackers can exploit this vulnerability by providing untrusted data to the affected files, leading to the execution of malicious code on the server. This can result in unauthorized access, data manipulation, or even a complete compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the vulnerable files 'download.php' and 'upload.php' by modifying the server configuration or implementing access control rules. However, this is not a permanent solution, and updating to the latest patched versions is strongly advised.
Conclusion
The Deserialization vulnerability in nukeviet versions 4.5 and earlier, as well as nukeviet-egov version 1.2.02 and earlier, allows for the execution of arbitrary code. It is crucial to update to the latest patched versions (4.6 or later for nukeviet, and 1.2.03 or later for nukeviet-egov) to mitigate the risk. Restricting access to the vulnerable files can serve as a temporary workaround, but it is not a substitute for applying the updates.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
This vulnerability allows attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data manipulation, or a complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended updates to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending specially crafted requests to the affected files.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is essential to apply the necessary updates to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
