CVE-2024-5262
📋 TL;DR
This vulnerability in ProjectDiscovery Interactsh allows remote attackers to anonymously access and modify any files in the directory where the interactsh-server is running. It affects anyone running vulnerable versions of Interactsh server with SMB enabled, potentially exposing sensitive data and allowing file system manipulation.
💻 Affected Systems
- ProjectDiscovery Interactsh
📦 What is this software?
Interactsh by Projectdiscovery
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the server's file system, allowing attackers to read sensitive configuration files, write malicious scripts, or delete critical system files leading to service disruption.
Likely Case
Unauthorized access to sensitive files in the interactsh-server directory, potentially exposing logs, configurations, or other data stored alongside the application.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external SMB connections to the server.
🎯 Exploit Status
Exploitation requires network access to the SMB port (typically 445) and knowledge of the server's IP address.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version including PR #874 fix
Vendor Advisory: https://github.com/projectdiscovery/interactsh/pull/874
Restart Required: Yes
Instructions:
1. Update Interactsh to the latest version containing the fix from PR #874. 2. Restart the interactsh-server service. 3. Verify SMB anonymous access is properly restricted.
🔧 Temporary Workarounds
Disable SMB Server
allDisable the SMB server functionality in Interactsh configuration
Edit interactsh configuration to set smb.enabled: false
Block SMB Port
linuxBlock external access to SMB port (445) using firewall rules
sudo ufw deny 445/tcp
sudo iptables -A INPUT -p tcp --dport 445 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the Interactsh server from untrusted networks
- Monitor SMB port (445) for unauthorized access attempts and implement intrusion detection
🔍 How to Verify
Check if Vulnerable:
Test if anonymous SMB access is possible to the interactsh-server directory using smbclient or similar toolsCheck Version:
interactsh-server --versionVerify Fix Applied:
Attempt anonymous SMB connection to verify access is now properly restricted📡 Detection & Monitoring
Log Indicators:
- Anonymous SMB connection attempts
- Unauthorized file access patterns in server logs
Network Indicators:
- Unexpected SMB traffic to port 445
- Anonymous SMB authentication attempts
SIEM Query:
source="interactsh" AND (event="anonymous_login" OR event="smb_access")