CVE-2021-43857

Gerapy may contain remote code execution vulnerability

CVSS 9.8 CRITICALEPSS 55.6%CWE-78

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 55.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

27 Dec 2021Published on NVD

05 Jan 2022Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Gerapy · Gerapy

public PoCs found — 6

githubgithub.com/lowkey0808/CVE-2021-43857★ 1 githubgithub.com/G4sp4rCS/CVE-2021-43857-POC★ 0 githubgithub.com/ProwlSec/gerapy-cve-2021-43857★ 0 githubgithub.com/afifudinmtop/CVE-2021-43857-Gerapy-v0.9.7★ 0 cve_referencepacketstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/50640unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.html https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28 https://github.com/Gerapy/Gerapy/issues/219 https://github.com/Gerapy/Gerapy/security/advisories/GHSA-9w7f-m4j4-j3xw