Remote Code Execution Vulnerability in MailDev 2 through 2.1.0
CVE-2024-27448

9.1CRITICAL

Key Information:

Vendor

MailDev

Vendor
CVE Published:
5 April 2024

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2024-27448?

The CVE-2024-27448 vulnerability in MailDev 2 through 2.1.0 allows remote code execution via a crafted Content-ID header for an e-mail attachment. The vulnerability can lead to lib/mailserver.js writing arbitrary code into the routes.js file. Exploiting this flaw could lead to unauthorized modification or deletion of critical files and even remote code execution. It is important for users of MailDev to update their software to the latest, patched version to mitigate this security risk.

News Articles

favicon imageIntrix Cyber Security

Exposing a Major Security Flaw in MailDev: Inside the CVE-2024-27448 Vulnerability - Intrix Cyber Security

Delve into what makes the CVE-2024-27448 vulnerability a critical issue on MailDev for email testing and development.

References

https://github.com/Tim-Hoekstra/MailDev-2.1.0-Exploit-RCE
https://github.com/maildev/maildev/releases
https://intrix.com.au/articles/exposing-major-security-fl...

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by Intrix Cyber Security

  • Vulnerability published

  • Vulnerability Reserved

.