CVE-2024-37743
BaseFortify
Publication date: 2025-06-24
Last updated on: 2025-07-09
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mmz-001 | knowledgegpt | 0.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in KnowledgeGPT version 0.0.5 occurs in the document display component due to the use of the Streamlit function st.markdown with the parameter unsafe_allow_html=True, which allows rendering of HTML content without proper sanitization. This enables attackers to embed and execute malicious scripts within uploaded files. Additionally, the file upload and reading processes lack sufficient validation, allowing harmful code execution within the application context. [1]
How can this vulnerability impact me? :
An attacker can remotely execute arbitrary code on the affected system by exploiting this vulnerability. This can lead to full compromise of the application, including unauthorized access, data theft, data manipulation, or disruption of service. Since the vulnerability allows execution of malicious scripts without user interaction or privileges, it poses a critical security risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on identifying usage of the vulnerable KnowledgeGPT version 0.0.5, especially the document display component using Streamlit's st.markdown with unsafe_allow_html=True. Monitoring for uploads of files containing embedded HTML or scripts without sanitization may help. Specific commands are not provided in the resources, but inspecting the application code for unsafe_allow_html=True usage and scanning uploaded files for malicious scripts are recommended approaches. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of unsafe_allow_html=True in the st.markdown function within the application, implementing specialized HTML sanitization libraries to remove dangerous scripts from uploaded files, and exercising extra caution when deploying KnowledgeGPT version 0.0.5 in production environments. [1]