#VU88827 Improper Neutralization of Argument Delimiters in a Command in Flatpak - CVE-2024-32462

Vulnerability identifier: #VU88827

Vulnerability risk: Low

CVSSv4.0: 5.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-32462

CWE-ID: CWE-88

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Flatpak
Server applications / Frameworks for developing and running applications

Vendor: Flatpak

Description

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to improper input validation when handling CLI arguments in the RequestBackground portal. A malicious application can escape sandbox via a specially crafted arguments and execute arbitrary code on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Flatpak: 1.10.0 - 1.15.7

---

External links
https://github.com/flatpak/flatpak/security/advisories/GHSA-phv6-cpc2-2fgj
https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d
https://github.com/flatpak/flatpak/commit/81abe2a37d363f5099c3d0bdcd0caad6efc5bf97
https://github.com/flatpak/flatpak/commit/b7c1a558e58aaeb1d007d29529bbb270dc4ff11e
https://github.com/flatpak/flatpak/commit/bbab7ed1e672356d1a78b422462b210e8e875931
https://github.com/flatpak/flatpak/releases/tag/1.14.6
https://github.com/flatpak/flatpak/releases/tag/1.15.8
https://github.com/flatpak/flatpak/releases/tag/1.12.9
https://github.com/flatpak/flatpak/releases/tag/1.10.9

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.