CVE-2024-3955
📋 TL;DR
CVE-2024-3955 is a critical command injection vulnerability in CraftBeerPi 4 that allows unauthenticated remote attackers to execute arbitrary commands on the system by manipulating the 'logtime' parameter. This affects all users running vulnerable versions of CraftBeerPi 4, particularly those with internet-facing instances. The vulnerability stems from improper input validation before passing user-controlled data to the os.system() function.
💻 Affected Systems
- CraftBeerPi 4
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install malware, exfiltrate data, pivot to other systems, or cause physical damage to brewing equipment.
Likely Case
Attacker gains shell access to the CraftBeerPi server, potentially compromising the entire system and any connected brewing equipment.
If Mitigated
Limited impact due to network segmentation, proper input validation, and restricted user permissions.
🎯 Exploit Status
The vulnerability is straightforward to exploit with simple HTTP requests containing command injection payloads in the logtime parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.1.a1 (commit 57572c7) and later
Vendor Advisory: https://github.com/PiBrewing/craftbeerpi4/issues/132
Restart Required: Yes
Instructions:
1. Backup your configuration and data. 2. Update CraftBeerPi 4 to version 4.4.1.a1 or later using: git pull origin master. 3. Restart the CraftBeerPi service. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the logtime parameter before processing
Modify cbpi/http_endpoints/http_system.py to validate logtime parameter contains only expected characters (digits, letters, hyphens, underscores)
Network Access Restriction
linuxRestrict network access to CraftBeerPi service
sudo ufw deny 5000/tcp
sudo iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Immediately isolate the CraftBeerPi system from the internet and restrict network access to trusted IPs only
- Implement a web application firewall (WAF) with command injection rules to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Check if your CraftBeerPi version is between 4.0.0.58 and 4.4.1.a1, or test by sending a request with command injection in logtime parameterCheck Version:
Check the CraftBeerPi web interface or examine the git commit historyVerify Fix Applied:
Verify version is 4.4.1.a1 or later and test that command injection attempts are properly rejected📡 Detection & Monitoring
Log Indicators:
- Unusual system commands in CraftBeerPi logs
- Multiple failed command injection attempts
- Suspicious logtime parameter values in HTTP logs
Network Indicators:
- HTTP requests to /api/system/log/download with unusual logtime parameters
- Outbound connections from CraftBeerPi to unexpected destinations
SIEM Query:
source="craftbeerpi" AND ("logtime" CONTAINS "|" OR "logtime" CONTAINS ";" OR "logtime" CONTAINS "`" OR "logtime" CONTAINS "$")