CVE-2024-3955: CraftBeerPi 4 allows arbitrary code execution
Summary
CVE-2024-3955: CraftBeerPi 4 allows arbitrary code execution. Affects cbpi4 versions >= 4.0.0.58, < 4.4.1.a1. Fixed in 4.4.1.a1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CraftBeerPi 4 is an open-source software package designed for controlling and monitoring home brewing processes. It provides a user-friendly interface for managing temperature, fermentation, and other brewing parameters. CraftBeerPi 4 is widely used by home brewers to automate and streamline their brewing operations.
Vulnerability Detail
CraftBeerPi 4 is vulnerable to arbitrary code execution due to a lack of input validation in the "downloadlog" function from "cbpi/http_endpoints/http_system.py". The vulnerability arises from the insecure handling of the "logtime" URL GET parameter, which is directly passed to the "os.system" function in "cbpi/controller/system_controller.py". An attacker can exploit this vulnerability by manipulating the "logtime" parameter to execute arbitrary commands on the underlying system. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability affects CraftBeerPi 4 versions from 4.0.0.58 to 4.4.1.a1.
How To Fix
Latest published version: 4.7.7 as of 22 Oct 2026
pip install --upgrade "cbpi4==4.7.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.1.a1
This is the first release that contains the fix.
pip install --upgrade "cbpi4==4.4.1.a1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality by modifying the code. In the "cbpi/http_endpoints/http_system.py" file, the "downloadlog" function can be modified to validate and sanitize the "logtime" parameter before further processing. Here's an example of the modified code:
def downloadlog():
logtime = request.args.get('logtime')
# Validate and sanitize the logtime parameter
if logtime is None or not logtime.isdigit():
return 'Invalid logtime parameter'
# Rest of the code
...
By implementing this workaround, the vulnerability can be mitigated until the official fix is applied.
Conclusion
CraftBeerPi 4 is vulnerable to arbitrary code execution due to a lack of input validation in the "downloadlog" function. This can be exploited by an attacker to execute arbitrary commands on the system. It is crucial to update CraftBeerPi 4 to version 4.4.1.a1 or later to fix the vulnerability. In the meantime, a temporary workaround is available by modifying the code to validate and sanitize the "logtime" parameter. Stay vigilant and ensure the security of your CraftBeerPi 4 installation.
See every vulnerability recorded for cbpi4 →
FAQ
CraftBeerPi 4 is an open-source software package used for controlling and monitoring home brewing processes. It provides a user-friendly interface for managing temperature, fermentation, and other brewing parameters.
The vulnerability allows an attacker to execute arbitrary code on the affected system. This can lead to unauthorized access, data leakage, or complete compromise of the system.
CraftBeerPi 4 versions from 4.0.0.58 to 4.4.1.a1 are affected by this vulnerability.
To fix this vulnerability, update CraftBeerPi 4 to version 4.4.1.a1 or later. This will patch the vulnerability and ensure the system is secure.
Yes, a temporary workaround is to modify the code in the "downloadlog" function to validate and sanitize the "logtime" parameter before further processing. This can help mitigate the vulnerability until the official fix is applied.
