8.8
HIGH
CVE-2024-8504
VICIdial Root Shell Command Execution
Description

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

INFO

Published Date :

Sept. 10, 2024, 8:15 p.m.

Last Modified :

Sept. 12, 2024, 2:35 p.m.

Source :

bbf0bd87-ece2-41be-b873-96928ee8fab9

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

2.8
Public PoC/Exploit Available at Github

CVE-2024-8504 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-8504 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Vicidial vicidial
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-8504.

URL Resource
https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt
https://www.vicidial.org/vicidial.php

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CVE-2024-8504

Python

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 22, 2024, 8:17 p.m. This repo has been linked 1 different CVEs too.

VICIdial Unauthenticated SQLi to RCE Exploit (CVE-2024-8503 and CVE-2024-8504)

Python

Updated: 1 month, 2 weeks ago
25 stars 4 fork 4 watcher
Born at : Sept. 14, 2024, 6:27 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-8504 vulnerability anywhere in the article.

  • Cybersecurity News
Google Pays $55,000 Bounty for Chrome Security Flaw

Google has released a Stable Channel update for Chrome on Windows, Mac, and Linux, bringing the browser to version 129.0.6668.100/.101. The update is expected to roll out over the next few days and in ... Read more

Published Date: Oct 09, 2024 (3 weeks, 6 days ago)
  • Cybersecurity News
Microsoft’s October 2024 Patch Tuesday: Zero-Day Exploits and Critical Vulnerabilities Patched

Microsoft’s October 2024 Patch Tuesday delivered a crucial set of security updates, addressing a total of 121 vulnerabilities across its ecosystem. This includes three critical vulnerabilities and 114 ... Read more

Published Date: Oct 09, 2024 (3 weeks, 6 days ago)
  • Cybersecurity News
CyberVolk: From Hacktivism to Ransomware – Researcher Exposes New Threat

CyberVolk dialog window | Image: Rapid7Cybersecurity researchers at Rapid7 Labs have released a detailed report on CyberVolk, a politically motivated hacktivist group that transitioned into using rans ... Read more

Published Date: Oct 07, 2024 (4 weeks, 1 day ago)
  • Cybersecurity News
CVE-2024-5102: Avast Antivirus Flaw Could Allow Hackers to Delete Files and Run Code as SYSTEM

A high-severity vulnerability (CVE-2024-5102) has been discovered in Avast Antivirus for Windows, potentially allowing attackers to gain elevated privileges and wreak havoc on users’ systems. This fla ... Read more

Published Date: Oct 03, 2024 (1 month ago)
  • Cybersecurity News
CVE-2024-20432 (CVSS 9.9): Cisco Nexus Dashboard Fabric Controller Exposed to RCE

Cisco has issued a security advisory addressing a critical vulnerability (CVE-2024-20432) in its Nexus Dashboard Fabric Controller (NDFC). This flaw, which carries a severity rating of 9.9 out of 10 o ... Read more

Published Date: Oct 03, 2024 (1 month ago)
  • Cybersecurity News
CVE-2024-8940 (CVSS 10): Critical Flaw in Scriptcase Low-Code Platform Leaves Developers at Risk

Developers using the popular low-code platform Scriptcase are urged to update their software immediately after discovering three critical vulnerabilities that could expose their applications to seriou ... Read more

Published Date: Oct 02, 2024 (1 month ago)
  • Cybersecurity News
30 Exploitable Flaws: Alarming Study on Home Router Defaults

A study titled “Exposed by Default: A Security Analysis of Home Router Default Settings” has shed light on the pervasive vulnerabilities present in home routers, highlighting significant risks associa ... Read more

Published Date: Sep 25, 2024 (1 month, 1 week ago)
  • Cybersecurity News
Unmasking “Marko Polo”: The Infostealer Gang Targeting Thousands

Marko Polo infection chain (Source: Recorded Future)Researchers at Recorded Future have uncovered a large-scale cyberattack affecting tens of thousands of devices worldwide. It was later revealed that ... Read more

Published Date: Sep 20, 2024 (1 month, 2 weeks ago)
  • Cybersecurity News
CISA Flags Two Actively Exploited Vulnerabilities: Critical Threats to Windows and WhatsUp Gold

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, adding two actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immedia ... Read more

Published Date: Sep 17, 2024 (1 month, 2 weeks ago)
  • seclists.org
KL-001-2024-012: VICIdial Authenticated Remote Code Execution

Full Disclosure mailing list archives KL-001-2024-012: VICIdial Authenticated Remote Code Execution From: KoreLogic Disclosures via Fulldisclosure <fulldisclosure () seclists org> Date: Tue, 10 Sep 20 ... Read more

Published Date: Sep 10, 2024 (1 month, 3 weeks ago)

The following table lists the changes that have been made to the CVE-2024-8504 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Sep. 12, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 CISA-ADP AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE Received by bbf0bd87-ece2-41be-b873-96928ee8fab9

    Sep. 10, 2024

    Action Type Old Value New Value
    Added Description An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
    Added Reference KoreLogic https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt [No types assigned]
    Added Reference KoreLogic https://www.vicidial.org/vicidial.php [No types assigned]
    Added CWE KoreLogic CWE-78
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-8504 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability