CVE-2024-28892: GoCast OS Command Injection vulnerability

December 20, 2024 (updated December 26, 2024)

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

References

github.com/advisories/GHSA-5qww-56gc-f66c
github.com/mayuresh82/gocast
nvd.nist.gov/vuln/detail/CVE-2024-28892
talosintelligence.com/vulnerability_reports/TALOS-2024-1960
www.talosintelligence.com/vulnerability_reports/TALOS-2024-1960

Code Behaviors & Features

Detect and mitigate CVE-2024-28892 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →