GHSL-2024-098: Authenticated remote code execution in Elektra - CVE-2024-41961
Authenticated Elektra users were able to execute arbitrary code and potentially access otherwise unreachable remote systems; attackers could have also triggered code execution by sending crafted links to authenticated users.
Other sources
Elektra from SAP’s Converged Cloud org was susceptible to a remote code execution vulnerability. Authenticated users were able to execute arbitrary code in the context of Elektra and through this potentially access remote systems to which they would have had no access otherwise. Additionally, attackers could have sent links containing a malicious payload to authenticated Elektra users, which also would have triggered code execution.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated Elektra users are directly exposed because they could execute arbitrary code. Authenticated users who receive crafted links may also be exposed if an attacker can induce code execution through those links.
What does an attacker need to exploit it?
The issue can be exploited by an authenticated Elektra user. Alternatively, an attacker could send a crafted link to an authenticated user to trigger code execution.
What is the potential impact beyond the Elektra environment?
Successful exploitation could allow arbitrary code execution and may enable access to remote systems that would otherwise be unreachable.