CVE-2024-48987
📋 TL;DR
Snipe-IT versions before 7.0.10 contain a remote code execution vulnerability via cookie serialization when an attacker obtains the APP_KEY. This allows unauthenticated attackers to execute arbitrary code on affected systems. Organizations using Snipe-IT with default or exposed APP_KEY values are at risk.
💻 Affected Systems
- Snipe-IT
📦 What is this software?
Snipe It by Snipeitapp
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary commands, access sensitive data, install malware, and pivot to other systems.
Likely Case
Unauthenticated remote code execution leading to data theft, system manipulation, and potential ransomware deployment.
If Mitigated
Limited impact if APP_KEY is properly secured and system is isolated, though vulnerability still exists in code.
🎯 Exploit Status
Exploitation requires APP_KEY knowledge, but default keys in repository make this trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.10
Vendor Advisory: https://github.com/snipe/snipe-it/releases/tag/v7.0.10
Restart Required: Yes
Instructions:
1. Backup your database and files. 2. Update to Snipe-IT v7.0.10 via git pull or fresh install. 3. Run 'php artisan migrate'. 4. Clear cache with 'php artisan config:clear'. 5. Restart web server.
🔧 Temporary Workarounds
Change APP_KEY
allGenerate and set a new, strong APP_KEY to prevent exploitation with known/default keys.
php artisan key:generate
Restrict .env Access
linuxSecure .env file permissions to prevent APP_KEY exposure.
chmod 600 .env
chown www-data:www-data .env
🧯 If You Can't Patch
- Change APP_KEY immediately using 'php artisan key:generate'
- Implement strict network segmentation and firewall rules to limit Snipe-IT access
🔍 How to Verify
Check if Vulnerable:
Check Snipe-IT version in web interface or via 'php artisan --version' command.Check Version:
php artisan --versionVerify Fix Applied:
Confirm version is 7.0.10 or higher and APP_KEY has been changed from default values.📡 Detection & Monitoring
Log Indicators:
- Unusual cookie values in web logs
- Unexpected PHP artisan command execution
- Suspicious Laravel serialization errors
Network Indicators:
- HTTP requests with manipulated cookie data
- Unusual outbound connections from Snipe-IT server
SIEM Query:
source="web_logs" AND (cookie="*snipeit_session*" AND (uri="*php*" OR user_agent="*curl*" OR user_agent="*wget*"))