Insecure handling of GET argument in Phoniebox

published 2024-07-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-32370

cvss: 8.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause one of the following (depending on the chosen payload): shell command execution, reflected XSS or cross-site request forgery.

This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.

Patch / fix

fixed in 1

Phoniebox Phoniebox 3.0

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-07-10)

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Phoniebox Phoniebox
sourcefabric phoniebox

Classification

Weakness

CWE-352 Cross-Site Request Forgery
CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

cert.pl /en/posts/2024/07/CVE-2024-3798
third-party-advisory
cert.pl /posts/2024/07/CVE-2024-3798
third-party-advisory
github.com /MiczFlor/RPi-Jukebox-RFID/issues/2342
issue-tracking

Sources

CVE List CVE-2024-3798
NVD CVE-2024-3798

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary