CVE-2025-25286
CVE-2025-25286 · Crayfish allows Remote Code Execution via Homarus Authorization header
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
CVSS 9.8 · Critique · EPSS 1,0% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
crayfish
- Versions du logiciel
- < 4.1.0: Concernée
Aucun correctif publié
islandora/crayfish Packagist
- Versions du logiciel
- 0.0.1
- 0.0.10
- 0.0.11
- 0.0.12
- 0.0.13
- 0.0.14
- 0.0.15
- 0.0.2
- 0.0.3
- 0.0.4
- 0.0.5
- 0.0.6
- 0.0.7
- 0.0.8
- 0.0.9
- 0.1.0
- 0.2.0
- 0.2.1
- 1.0.0
- 1.1.1
- 2.0.0
- 2.1.0
- 3.0.0
- 4.0.0
- Plages de versions concernées
- ECOSYSTEM: < 4.1.0
Mettez à jour vers 4.1.0