CVE-2024-42360: 
Ruby vulnerability analysis and mitigation

CVE-2024-42360 affects SequenceServer, a software that enables rapid setup of BLAST+ servers with an intuitive user interface. The vulnerability was discovered and disclosed in August 2024, affecting versions prior to 3.1.2. The issue stems from several HTTP endpoints that failed to properly sanitize user input and query parameters (GitHub Advisory, NVD).

The vulnerability is classified as a Command Injection vulnerability (CWE-77). It has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating the highest severity level. The issue specifically relates to improper sanitization of user input and query parameters in HTTP endpoints, which could allow command injection attacks (NVD).

The vulnerability allows attackers to inject and execute arbitrary shell commands on the affected system. Given the CVSS score and vector, this indicates that an attacker can achieve complete system compromise without requiring any privileges or user interaction, potentially leading to full system access (GitHub Advisory).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. The attack can be performed remotely through network access, as indicated by the CVSS vector showing Network (N) for attack vector and Low (L) for attack complexity (NVD).

The vulnerability has been patched in SequenceServer version 3.1.2. Users are strongly advised to upgrade to this version to address the security issue. No alternative workarounds have been provided (GitHub Advisory).