CVE-2024-8517: 
Linux Debian vulnerability analysis and mitigation

SPIP before versions 4.3.2, 4.2.16, and 4.1.18 contains a critical command injection vulnerability (CVE-2024-8517). A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. The vulnerability was discovered in September 2024 and affects all versions of SPIP since version 4.0 (SPIP Blog).

The vulnerability exists in the BigUp plugin's file upload functionality, specifically in the extrairefichiersvalides function within plugins-dist/bigup/inc/Bigup/Files.php. The issue stems from improper sanitization of user-supplied data during file uploads when the bigupretrouverfichiers parameter is set. The vulnerability involves the use of eval() function to process file upload parameters, allowing command injection through crafted multipart requests. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) (VulnCheck, ThinkLoveShare).

The vulnerability allows attackers to execute arbitrary operating system commands on affected servers without requiring authentication. This gives attackers complete control over the system, potentially leading to data theft, system compromise, and further network penetration. The vulnerability affects institutional sites, community portals, academic websites, associations, personal blogs, and news sites running SPIP CMS (SecurityOnline).

Users are strongly urged to update their SPIP installations to the latest secure versions: 4.3.2, 4.2.16, or 4.1.18. For branches that are no longer maintained (such as SPIP 4.0), users can implement security through the latest version of the security screen. The vulnerability is also addressed by the built-in WAF through commit 091eba6a7969b502dbe53c58a509b4c2a650f802 (SPIP Blog).

The security community has actively discussed this vulnerability, with multiple researchers confirming its severity. The SPIP development team responded promptly to the vulnerability report and released patches. The discovery was particularly notable as it was found during a security challenge, leading to collaborative research efforts between security researchers (ThinkLoveShare).