Insecure handling of GET argument in Phoniebox
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering, Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352, CWE-78 and CWE-79.
Summary
Insecure handling of GET header parameter file included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause one of the following (depending on the chosen payload): shell command execution, reflected XSS or cross-site request forgery. This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Phoniebox (Phoniebox) Fixed in 3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3798
- 2026-10-03 Alias added: GHSA-954r-8vpp-vj52
References
More Phoniebox vulnerabilities
- TI-2024-03545 Shell command injection in Phoniebox CVSS 4.0HIGH 8.7
Sources
- CVE-2024-3798 · CVE Program
- CVE-2024-3798 · NVD
- FIRST EPSS
- GHSA-954r-8vpp-vj52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences