Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

OpenCanary: Malicious Config File Can Run Commands as Root

CVE-2024-48911 · published 2 years ago
Summary

A security fix is available for OpenCanary, a network monitoring tool. Prior to version 0.9.4, a misconfigured OpenCanary setup could allow an attacker to execute commands with root privileges. Update to version 0.9.4 or later to protect your system.

What to do
  • Update thinkst applied research opencanary to version 0.9.5.
  • Update thinkst opencanary to version 0.9.4 or later.
Affected software
Ecosystem VendorProductAffected versions
pip thinkst applied research opencanary < 0.9.5
Fix: upgrade to 0.9.5
– thinkst opencanary < 0.9.4
cpe:2.3:a:thinkst:opencanary:*:*:*:*:*:*:*:*
Original advisory text
OpenCanary Executes Commands From Potentially Writable Config File
OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published14 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-pf5v-pqfv-x8jj · GHSA
CVE-2024-48911 · NVD
CVE-2024-48911 · OSV
Track software like this
Free during beta