CVE-2024-41956 - CVE House

Back to Database

Status published High CVE-2024-41956

Soft Serve allows arbitrary code execution by crafting git-lfs requests

8.1 CVSS

Vulnerability Description

Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41956

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from charmbracelet

View All →

Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve does not sanitize ANSI escape sequences in user input

Soft Serve is vulnerable to arbitrary file writing through its SSH API

Soft Serve allows path traversal attacks

Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled

Affected Vendor

charmbracelet

View all reports →

Affected Software

soft-serve

Vulnerable Versions:

< 0.7.5

Timeline

Official Publish: August 1st, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel