CVE-2024-48987: Snipe-IT Remote Code Execution Vulnerability
Summary
CVE-2024-48987: Snipe-IT remote code execution. Affects snipe/snipe-it versions < 7.0.10. Fixed in 7.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snipe-IT is an open-source asset management system designed to help organizations manage their IT assets effectively. It provides features such as asset tracking, user management, and reporting. However, prior to version 7.0.10, Snipe-IT is vulnerable to a remote code execution flaw due to improper cookie serialization, which can be exploited if an attacker knows the APP_KEY.
Vulnerability Detail
The vulnerability arises from the way Snipe-IT handles cookie serialization. If an attacker gains knowledge of the APP_KEY, they can exploit this flaw to execute arbitrary code on the server. This issue is further compounded by the presence of default APP_KEY values in .env files, which may be accessible from the product's repository. The potential ramifications include unauthorized access to sensitive data, system compromise, and complete control over the affected server.
How To Fix
Minimum fixed version
7.0.10
This is the first release that contains the fix.
composer require snipe/snipe-it:7.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the .env files and ensure that the APP_KEY is not set to its default value. Additionally, consider implementing web application firewalls to monitor and block suspicious activities.
Conclusion
The Snipe-IT remote code execution vulnerability (CVE-2024-48987) poses a significant risk to users of versions prior to 7.0.10. It is crucial to update to the patched version to mitigate this risk and protect sensitive data from potential exploitation.
See every vulnerability recorded for snipe/snipe-it →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If immediate updating is not possible, implement workarounds such as restricting access to sensitive files and monitoring for unusual activity.
Updating should not cause data loss, but it is always recommended to back up your data before performing any updates.
You can find more information about Snipe-IT on their official website or GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for snipe/snipe-it.
