Arbitrary file overwrite in Spotify luigi



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-21542
CWE-ID CWE-73
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Luigi
Web applications / Remote management & hosting panels

Vendor Spotify

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) External Control of File Name or Path

EUVDB-ID: #VU105947

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-21542

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to improper validation of file names when unpacking them from an archive in the _extract_packages_archive() function. A remote attacker can pass a specially crafted archive to the application and overwrite arbitrary files on the system (a.k.a. Zip Slip vulnerability).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Luigi: 1.0.16 - 3.5.2

CPE2.3 External links

https://github.com/spotify/luigi/commit/b5d1b965ead7d9f777a3216369b5baf23ec08999
https://github.com/spotify/luigi/issues/3301
https://github.com/spotify/luigi/releases/tag/v3.6.0
https://security.snyk.io/vuln/SNYK-PYTHON-LUIGI-7830489


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###