CVE-2024-54794
📋 TL;DR
CVE-2024-54794 is a command injection vulnerability in SpagoBI 3.5.1 that allows attackers to execute arbitrary code through the script input feature. This affects all organizations running vulnerable SpagoBI instances, potentially compromising the entire server.
💻 Affected Systems
- SpagoBI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover leading to data exfiltration, lateral movement, ransomware deployment, or persistent backdoor installation.
Likely Case
Unauthorized code execution leading to data theft, system manipulation, or service disruption.
If Mitigated
Limited impact through network segmentation and proper access controls, but still significant risk to the SpagoBI server.
🎯 Exploit Status
Exploitation requires authentication to SpagoBI. Public proof-of-concept code is available in the referenced GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Disable script input feature
allDisable or restrict access to the vulnerable script input functionality in SpagoBI configuration.
Modify SpagoBI configuration files to disable script execution features
Network segmentation
allIsolate SpagoBI server from critical systems and restrict network access.
Configure firewall rules to limit inbound/outbound connections to SpagoBI server
🧯 If You Can't Patch
- Implement strict access controls and limit user permissions to only necessary functions
- Monitor SpagoBI logs for suspicious script execution attempts and implement intrusion detection
🔍 How to Verify
Check if Vulnerable:
Check if running SpagoBI version 3.5.1. Review configuration for script input feature availability.Check Version:
Check SpagoBI version through web interface or configuration filesVerify Fix Applied:
Verify script input feature is disabled or restricted. Test that script execution is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unusual script execution in SpagoBI logs
- Suspicious user activity with script input features
Network Indicators:
- Unexpected outbound connections from SpagoBI server
- Command and control traffic patterns
SIEM Query:
Search for 'script execution' or 'command injection' patterns in SpagoBI application logs