CVE-2024-28892: 
Linux openSUSE vulnerability analysis and mitigation

An OS command injection vulnerability (CVE-2024-28892) was discovered in GoCast version 1.1.3. The vulnerability exists in the name parameter and was disclosed on November 21, 2024. The affected software, GoCast, is a tool that provides BGP routing for advertisements from a host using GoBGP, commonly used for anycast-based load balancing for infrastructure service instances (Talos Report).

The vulnerability occurs when the name of an app is used to create the label of a new loopback interface. The injection point is located in system.go:addLoopback function, with the exploitation limited to a string length of 12 characters due to Linux Kernel network interface label size restrictions. The vulnerability has been assigned a CVSSv3 score of 9.8 (CRITICAL) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (Talos Report).

A successful exploitation of this vulnerability can lead to arbitrary command execution on the affected system. The vulnerability is particularly severe as it can be triggered through an unauthenticated HTTP request, potentially allowing remote attackers to gain unauthorized access and execute commands on the target system (Talos Report).

Users are advised to implement several mitigation strategies: 1) Disable the HTTP API or implement authentication through a proxy if the API cannot be disabled, 2) Disable Consul integration if possible, 3) Verify that file permissions for the configuration file prevent users other than root and the GoCast user from modifying it. For developers, it is recommended to implement proper input sanitization by surrounding the label argument with single quotes and removing all single quotes from the label string before insertion into the command (Talos Report).

The vulnerability was discovered by Matt Street and Edwin Molenaar of Cisco Meraki and was publicly disclosed after a coordinated vulnerability disclosure process that began in April 2024. The vendor was contacted multiple times throughout 2024, with a patch reported as upcoming in May 2024 (Talos Report, Talos Blog).