What is the CVSS score of CVE-2024-3924?

CVE-2024-3924 has a CVSS 3.0 base score of 4.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2024-3924?

Yes, a patch is available for CVE-2024-3924. Update the affected software to the latest version immediately.

CVE-2024-3924

MEDIUM

Code Injection (CWE-94)

2024-05-30 security@huntr.dev

Code Injection RCE

4.4

CVSS 3.0 · Vendor: huntr

Severity by source

Vendor (huntr) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (huntr) · only source for this CVE.

CVSS VectorVendor: huntr

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

May 30, 2024 - 15:15 cve.org

MEDIUM 4.4

DescriptionCVE.org

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.head_ref user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0.

AnalysisAI

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.head_ref user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner.0.0 and was fixed in version 2.0.0. Version information: version 2.0.0..

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.