CVE-2024-29640: 
Python vulnerability analysis and mitigation

An issue in aliyundrive-webdav version 2.3.3 and earlier was discovered that allows remote attackers to execute arbitrary code. The vulnerability exists in the action_query_qrcode component, specifically through the sid parameter (NVD, FortiGuard).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) with a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue specifically affects the OpenWrt plugin component of aliyundrive-webdav, where the sid parameter in the action_query_qrcode request is vulnerable to OS command injection (Vuln Detail).

The vulnerability allows attackers to execute arbitrary system commands on the affected system, potentially leading to complete system compromise. Given the CVSS score of 9.8, this represents a critical security risk with potential for high impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability is exploitable remotely without requiring authentication or user interaction. A proof of concept exists demonstrating command injection through the sid parameter in the action_query_qrcode request, allowing attackers to execute arbitrary system commands (Vuln Detail).

Users are advised to avoid using versions 2.3.3 and earlier of the aliyundrive-webdav package. The recommended action is to upgrade to a version newer than 2.3.3 when available (FortiGuard).