CVE-2024-24565

CrateDB database has an arbitrary file read vulnerability

CVSS 5.7 MEDIUMEPSS 3.1%CWE-22

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.7EPSS 3.1%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

30 Jan 2024Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected products

crate · crate

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/crate/crate/commit/4e857d675683095945dd524d6ba03e692c70ecd6 https://github.com/crate/crate/security/advisories/GHSA-475g-vj6c-xf96