CVE-2024-43791 RequestStore has Incorrect Default Permissions

2024-08-2314:39:10

CWE-276

GitHub_M

www.cve.org

cve-2024-43791

requeststore

default permissions

rack

1.3.2

0666 permissions

local users

arbitrary code

exploited

upgrade

production environments

local users

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.5%

JSON

RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

CNA Affected

[
  {
    "vendor": "steveklabnik",
    "product": "request_store",
    "versions": [
      {
        "version": "= 1.3.2",
        "status": "affected"
      }
    ]
  }
]