CVE-2021-43857

Gerapy may contain remote code execution vulnerability

CVSS 9.8 CRITICALEPSS 55.6%CWE-78

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Gerapy · Gerapy

public PoCs found — 6

githubgithub.com/lowkey0808/CVE-2021-43857★ 1 githubgithub.com/G4sp4rCS/CVE-2021-43857-POC★ 0 githubgithub.com/ProwlSec/gerapy-cve-2021-43857★ 0 githubgithub.com/afifudinmtop/CVE-2021-43857-Gerapy-v0.9.7★ 0 cve_referencepacketstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/50640unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.html https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28 https://github.com/Gerapy/Gerapy/issues/219 https://github.com/Gerapy/Gerapy/security/advisories/GHSA-9w7f-m4j4-j3xw