Plattform
python
Komponente
mesop
Behoben in
0.9.1
0.12.4
CVE-2024-45601 describes a file access vulnerability discovered and resolved in Mesop. This flaw stems from inadequate input validation within a specific endpoint, potentially allowing attackers to retrieve files not intended for public access. The vulnerability affects Mesop versions up to and including 0.9.5rc0. A fix is available in version 0.12.4, and users are strongly encouraged to upgrade immediately.
An attacker exploiting CVE-2024-45601 could bypass access controls and retrieve files not intended for public consumption. The scope of accessible files depends on the server's configuration and permissions. This could expose sensitive data such as configuration files, source code, or user data. While the description doesn't detail specific attack vectors, the potential for unauthorized data disclosure is significant. The blast radius is limited to the server hosting the Mesop application, but the impact can be substantial if sensitive information is compromised.
CVE-2024-45601 was publicly disclosed on 2024-09-18. No public proof-of-concept (PoC) code has been released at the time of writing. The vulnerability was reported by @Letm3through, who also proposed mitigations. It is not currently listed on the CISA KEV catalog. The probability of exploitation is currently assessed as medium, given the public disclosure and the potential for relatively straightforward exploitation once a PoC is developed.
Organizations deploying Mesop in production environments, particularly those handling sensitive data, are at risk. Shared hosting environments where Mesop instances share resources with other applications are also at increased risk, as a compromise of one instance could potentially lead to the compromise of others. Legacy Mesop deployments running older, unpatched versions are particularly vulnerable.
• python / server:
journalctl -u mesop -f | grep -i "file access"• generic web:
curl -I <mesop_endpoint> | grep -i "file:"disclosure
patch
Exploit-Status
EPSS
0.13% (32% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-45601 is to immediately upgrade Mesop to version 0.12.4 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider implementing stricter access controls on the server hosting Mesop to limit the potential impact of unauthorized file access. Review and harden the application's configuration to minimize the attack surface. While a WAF or proxy cannot directly address the underlying input validation issue, it can provide an additional layer of defense by filtering potentially malicious requests.
Actualice Mesop a la versión 0.12.4 o superior. Esto solucionará la vulnerabilidad de inclusión de archivos locales. Puede actualizar usando `pip install --upgrade mesop`.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-45601 is a HIGH severity vulnerability in Mesop versions ≤0.9.5rc0 that allows unauthorized access to files due to insufficient input validation. Upgrade to 0.12.4 to resolve.
Yes, if you are running Mesop version 0.9.5rc0 or earlier, you are affected by this vulnerability and should upgrade immediately.
Upgrade Mesop to version 0.12.4 or later. As a temporary workaround, implement a WAF rule to block suspicious requests to the vulnerable endpoint.
There are currently no confirmed reports of active exploitation, but the vulnerability's ease of exploitation suggests it could be targeted.
Refer to the Mesop project's official website or GitHub repository for the latest security advisory and release notes.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine requirements.txt-Datei hoch und wir sagen dir sofort, ob du betroffen bist.