CVE-2024-42360
📋 TL;DR
CVE-2024-42360 is a command injection vulnerability in SequenceServer BLAST+ server software where improper input sanitization in HTTP endpoints allows attackers to execute arbitrary shell commands. This affects all SequenceServer instances running vulnerable versions, potentially compromising the entire server. The vulnerability is critical with a CVSS score of 9.8.
💻 Affected Systems
- SequenceServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing arbitrary command execution as the SequenceServer process user, potentially leading to data theft, system takeover, or lateral movement within the network.
Likely Case
Remote code execution leading to installation of malware, data exfiltration, or use of the server as a pivot point for further attacks.
If Mitigated
Limited impact if server runs with minimal privileges, network segmentation is in place, and proper monitoring detects exploitation attempts.
🎯 Exploit Status
The advisory suggests exploitation is straightforward via HTTP requests to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.2
Vendor Advisory: https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
Restart Required: Yes
Instructions:
1. Stop SequenceServer service. 2. Update to version 3.1.2 using 'gem update sequenceserver'. 3. Restart SequenceServer service.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to SequenceServer to trusted IP addresses only
iptables -A INPUT -p tcp --dport [SequenceServer_port] -s [trusted_ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [SequenceServer_port] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to SequenceServer
- Run SequenceServer with minimal privileges using a dedicated low-privilege user account
🔍 How to Verify
Check if Vulnerable:
Check SequenceServer version with 'sequenceserver --version' or examine Gemfile.lock for sequenceserver gem versionCheck Version:
sequenceserver --versionVerify Fix Applied:
Confirm version is 3.1.2 or higher using 'sequenceserver --version'📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands in system logs
- HTTP requests with shell metacharacters in parameters
- Process execution from SequenceServer user outside normal patterns
Network Indicators:
- HTTP requests containing shell metacharacters like ;, |, &, $, (, ), {, } in query parameters
SIEM Query:
source="sequenceserver.log" AND ("cmd" OR "exec" OR "system" OR "bash" OR "sh")