Vulnerability in OSH Service Allows for Token Disclosure and Arbitrary Command Execution

CVE-2024-2243

What is CVE-2024-2243?

A vulnerability exists in the csmock component of the OSH service, where any user with a valid Kerberos ticket can exploit this flaw. This exploitation can lead to unauthorized disclosure of the Snyk authentication token, potentially allowing the attacker to execute arbitrary commands on OSH workers. The implications of this vulnerability highlight significant risks to confidentiality and integrity within systems utilizing the csmock OSH service.

References