CVE-2024-58278
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| indigostar | perl2exe | 30.10c |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in perl2exe versions up to V30.10C allows local authenticated attackers to execute arbitrary malicious scripts. Specifically, attackers can manipulate the 0th argument of packed executables to run another executable, effectively bypassing restrictions and gaining unauthorized access.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized code execution on affected systems by local authenticated users. This can result in attackers gaining unauthorized access, potentially compromising system integrity, confidentiality, and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying perl2exe-packaged executables of version V30.10C or earlier on your system and monitoring for unusual execution patterns where the 0th argument (argv[0]) is manipulated. You can search for perl2exe executables by locating files with known perl2exe signatures or names. For example, use commands like 'find / -type f -exec strings {} \; | grep -i perl2exe' to locate such executables. Additionally, monitor process execution logs for suspicious invocations where the 0th argument differs from the executable name. Since the exploit involves local authenticated users manipulating argv[0], auditing shell command histories and process arguments with tools like 'ps auxww' or 'auditd' rules can help detect exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading perl2exe to a version later than V30.10C where this vulnerability is fixed. If an upgrade is not immediately possible, restrict local authenticated user access to systems running vulnerable perl2exe executables. Implement strict file permission controls to prevent unauthorized modification or execution of malicious executables. Monitor and restrict the ability to manipulate the 0th argument of perl2exe executables by limiting shell access and using security policies. Additionally, consider applying application whitelisting and monitoring for unusual process executions to detect and prevent exploitation. [1, 3]