CVE-2024-3798 Information

Description

Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server it will cause one of the following (depending on the chosen payload): shell command execution reflected XSS or cross-site request forgery.

This issue affects Phoniebox in all releases through 2.7. Newer releases were not tested but they might also be vulnerable.

Reference

https://cert.pl/en/posts/2024/07/CVE-2024-3798 https://cert.pl/posts/2024/07/CVE-2024-3798 https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2342