Arbitrary Code Execution Vulnerability in RequestStore Rack (CVE-2017-1234)

CVE-2024-43791

What is CVE-2024-43791?

The RequestStore product by Steve Klabnik has a notable vulnerability due to the insufficient permissions set on its published files in version 1.3.2, which allow for world-writable access. This situation permits local users to execute arbitrary code, posing risks in environments where such access is available. Although this version was released in 2017 and most users have likely upgraded to more secure versions, awareness of this vulnerability is essential for maintaining secure production environments, particularly for those who might still be using the vulnerable version.

References