Security Digest · Vulnerability record
CVE-2024-3955: CraftBeerPi 4 allows arbitrary code execution
URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit…
CVSS 9.8 Critical EPSS 1.1% · p67
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.1%, percentile 67: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 67% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
cbpi4(PyPI) >= 4.0.0.58, < 4.4.1.a1, fixed in 4.4.1.a1. Check your lockfile, including transitive dependencies.
What it is
URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).
From the GitHub advisory
URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).
Weakness type: CWE-94.
Product: cbpi4 (PyPI) · Assigned by: CERT-PL · Published: 2024-05-02
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | cbpi4 | >= 4.0.0.58, < 4.4.1.a1 | 4.4.1.a1 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| PiBrewing | CraftBeerPi 4 | 4.0.0.58 (commit 563fae9) < 4.4.1.a1 (commit 57572c7) |
| CraftBeerPi - Brewing Controller | CraftBeerPi 4 | 4.0.0.58 (commit 563fae9) <= * |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADP | 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: unchanged
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 1.15% probability of exploitation activity in the next 30 days; percentile 67.
Timeline
- — CVE record published by CERT-PL
- — GitHub-reviewed advisory GHSA-4f92-w438-f484 published (critical)
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-4f92-w438-f484 github.com
- CVE.org record CVE-2024-3955 cve.org
- NVD entry CVE-2024-3955 nvd.nist.gov
Other references from the CVE record and advisory
- cert.pl cert.pl
- cert.pl cert.pl
- github.com github.com