CVE-2024-21855

Vulnerability

A missing authentication vulnerability exists in the HTTP API of GoCast 1.1.3. The API allows registration and unregistration of apps without authentication. The monitor parameter in app registration executes arbitrary commands via bash -c. Affected version: GoCast 1.1.3. [1]

Exploitation

An attacker can send an unauthenticated HTTP request to the API to register a malicious app with a crafted monitor parameter. No authentication or user interaction is required. The attacker can abuse BGP functionality, create NAT firewall rules, and execute arbitrary commands. [1]

Impact

Successful exploitation leads to arbitrary command execution with the privileges of the GoCast service, potentially resulting in full system compromise. The CVSS score is 9.8 (Critical) with high impact on confidentiality, integrity, and availability. [1]

Mitigation

No official patch is available as of the advisory. Users should disable the HTTP API or put it behind authentication using a reverse proxy. The vendor should provide authentication configuration and disable the API by default. [1]