Multiple vulnerabilities in Allegra

Published: 2024-08-23

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2024-30372 CVE-2024-5579 CVE-2024-5580 CVE-2024-5581
CWE-ID	CWE-94 CWE-502 CWE-22
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Allegra Server applications / Conferencing, Collaboration and VoIP solutions
Vendor	Steinbeis GmbH & Co. KG

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Code Injection

EUVDB-ID: #VU96467

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-30372

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due server-side template injection within the implementation of getLinkText method. A remote user can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Allegra: 5.1.0 - 7.5.1

CPE2.3

External links

http://www.zerodayinitiative.com/advisories/ZDI-24-1165/
http://alltena.com/en/resources/release-notes/relnotes-7-5-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Deserialization of Untrusted Data

EUVDB-ID: #VU96472

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-5579

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the renderFieldMatch method. A remote administrator can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Allegra: 5.1.0 - 7.5.1

CPE2.3

External links

http://www.zerodayinitiative.com/advisories/ZDI-24-1162/
http://alltena.com/en/resources/release-notes/relnotes-7-5-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Deserialization of Untrusted Data

EUVDB-ID: #VU96469

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-5580

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the loadFieldMatch method. A remote administrator can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Allegra: 5.1.0 - 7.5.1

CPE2.3

External links

http://www.zerodayinitiative.com/advisories/ZDI-24-1163/
http://alltena.com/en/resources/release-notes/relnotes-7-5-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Path traversal

EUVDB-ID: #VU96468

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-5581

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the unzipFile method. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system, leading to arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Allegra: 5.1.0 - 7.5.1

CPE2.3

External links

http://alltena.com/en/resources/release-notes/relnotes-7-5-2
http://www.zerodayinitiative.com/advisories/ZDI-24-1164/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.