Pre-Auth RCE via Path Traversal

The impact of this vulnerability is significant due to its pre-authentication nature and the potential for Remote Code Execution. An attacker could exploit this flaw to gain complete control of a FreeFlow Core instance, leading to data breaches, system compromise, and potential lateral movement within the network. Successful exploitation could allow an attacker to modify configurations, steal sensitive data, or even install malware. The lack of authentication requirements drastically lowers the barrier to entry for exploitation, increasing the overall risk.

Organizations utilizing FreeFlow Core in environments with limited network security controls are particularly at risk. Systems exposed directly to the internet or those with weak perimeter defenses are especially vulnerable. Any deployment of FreeFlow Core versions 7.0.0 through 7.0.11 should be considered at risk.

1. 2024-10-07Disclosure

   disclosure

1. Reserviert2024-09-26
2. Veröffentlicht2024-10-07
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-47556 is to immediately upgrade FreeFlow Core to version 7.0.11 or later. If upgrading is not immediately feasible, consider implementing strict access controls and network segmentation to limit the potential impact of a successful attack. While a direct workaround is unavailable, monitoring network traffic for suspicious requests targeting FreeFlow Core endpoints can provide early detection. After upgrading, confirm the fix by attempting to trigger the path traversal vulnerability and verifying that access is denied.