CVE-2025-25286
CVE-2025-25286 · Crayfish allows Remote Code Execution via Homarus Authorization header
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
CVSS 9.8 · Crítica · EPSS 1,0% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
crayfish
- Versiones
- < 4.1.0: Afectada
Sin corrección publicada
islandora/crayfish Packagist
- Versiones
- 0.0.1
- 0.0.10
- 0.0.11
- 0.0.12
- 0.0.13
- 0.0.14
- 0.0.15
- 0.0.2
- 0.0.3
- 0.0.4
- 0.0.5
- 0.0.6
- 0.0.7
- 0.0.8
- 0.0.9
- 0.1.0
- 0.2.0
- 0.2.1
- 1.0.0
- 1.1.1
- 2.0.0
- 2.1.0
- 3.0.0
- 4.0.0
- Intervalos de versiones afectados
- ECOSYSTEM: < 4.1.0
Actualiza a 4.1.0