Command Injection in sequenceserver

CRITICO 9.8CVE-2024-42360 · GHSA-qv32-5wm2-p32h · Published 14/08/2024 · updated 29/10/2026

In breve

CVE-2024-42360 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda sequenceserver, sequenceserver (wurmlab).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.58%, superiore al 48.2% delle vulnerabilità.
Correzione: aggiornare a 3.1.2 o successiva.

Package	Affected versions	Patched versions
sequenceserver RubyGems	`< 3.1.2`	`3.1.2`
sequenceserver wurmlab	`< 3.1.2`	`3.1.2`

Description

Impact

Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands

Patches

Fixed in 3.1.2

Workarounds

No known workarounds

NVD description

SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.

References

wurmlab/sequenceserver security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-42360 · ADVISORY
wurmlab/sequenceserver commit 457e527 · WEB
rubysec/ruby-advisory-db · WEB
wurmlab/sequenceserver · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free