CVE-2024-5820
Last modified
CVE-2024-5820 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any such malicious website to intercept all communication between the user and the backend. EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any such malicious website to intercept all communication between the user and the backend. This vulnerability can lead to unauthorized command execution and potential server-side request forgery.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Stitionai | Devika | 1.0 |
References
- https://huntr.com/bounties/2ba757bf-8ede-445b-b143-2de7769758a6Exploit, Third Party Advisory
- https://huntr.com/bounties/2ba757bf-8ede-445b-b143-2de7769758a6Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-5820?
How severe is CVE-2024-5820?
How do I fix CVE-2024-5820?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-5814A malicious TLS1.2 server can force a TLS1.3 client with dow…5.3
- CVE-2024-5815A Cross-Site Request Forgery vulnerability in GitHub Enterpr…6.5
- CVE-2024-5816An Incorrect Authorization vulnerability was identified in G…5.3
- CVE-2024-5817An Incorrect Authorization vulnerability was identified in G…6.5
- CVE-2024-5818The Royal Elementor Addons and Templates plugin for WordPres…5.4
- CVE-2024-5819The Gutenberg Blocks with AI by Kadence WP – Page Builder Fe…5.4
- CVE-2024-5821The vulnerability allows an attacker to access sensitive fil…6.2
- CVE-2024-5822A Server-Side Request Forgery (SSRF) vulnerability exists in…9.8
- CVE-2024-5823A file overwrite vulnerability exists in gaizhenbiao/chuanhu…9.1
- CVE-2024-58237In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-58238In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-58239In the Linux kernel, the following vulnerability has been re…5.5
Are you affected by CVE-2024-5820?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST