CVE-2024-5023: ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.9%, percentile 60: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 60% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes consoleme (PyPI) < 1.4.0, fixed in 1.4.0. Check your lockfile, including transitive dependencies.

What it is

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.

From the GitHub advisory

ID: NFLX-2024-002

Impact Authenticated users can achieve limited RCE in ConsoleMe, restricted to flag inputs on a single CLI command. Due to this constraint, it is not currently known whether full RCE is possible but it is unlikely. However, a specific flag allows authenticated users to read any server files accessible by the ConsoleMe process. Given ConsoleMe's role as an AWS identity broker, accessing files containing secrets on the server could potentially be exploited for privilege escalation.

Deployments of ConsoleMe that allow templated resources are impacted and urged to patch immediately. Deployments that do not permit templated resources are not affected.

To determine if your ConsoleMe deployment uses templated resources, check the configuration value for cacheresourcetemplates.repositories. If this value does not exist or is an empty array, your deployment is not impacted. Description The self-service flow for templated resources in ConsoleMe accepts a user-supplied JSON post body, which includes the filename for the templated resource. However, this user-supplied filename is not properly sanitized and is passed directly as a string to a CLI command. This allows users to input flags instead of filenames. By passing a specific flag with a filename value, users can induce an error that reveals the contents of the specified file, allowing them to read any files readable by the system user executing the ConsoleMe server process.

Patches This issue has been patched in version v1.4.0 via https://github.com/Netflix/consoleme/pull/9380. If you are unable to upgrade to the latest version, users can selectively apply the code changes in the above PR. Alternatively, removing the configuration item cacheresourcetemplates.repositories or adding it as an empty array should mitigate the issue, but will result in broken functionality (templated resources will no longer be supported for self-service).

Weakness type: CWE-77.

Product: consoleme (PyPI) · Assigned by: netflix · Published: 2024-05-16

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: low (any account)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.94% probability of exploitation activity in the next 30 days; percentile 60.

Timeline

• 2024-05-16 — CVE record published by netflix
• 2024-05-16 — GitHub-reviewed advisory GHSA-3783-62vc-jr7x published (critical)
• 2024-08-01 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-3783-62vc-jr7x github.com
2. CVE.org record CVE-2024-5023 cve.org
3. NVD entry CVE-2024-5023 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical PyPI advisories · Today’s Security Digest