KiTTY vulnerable to command injection via filename variable

CVE-2024-23749

What is CVE-2024-23749?

The vulnerability in KiTTY stems from insufficient input sanitization and validation of the filename variable, particularly in versions 0.76.1.13 and earlier. This flaw allows attackers to manipulate the filename input, leading to command injection. By exploiting this weakness, an attacker can inject malicious code through specially crafted filename entries during file retrieval operations. Such exploits can result in arbitrary code execution within the context of the application, emphasizing the need for stringent input validation and the implementation of secure coding practices to mitigate potential threats.

References