CVE-2024-53351
Published: 21 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-53351 involves insecure permissions in PipeCD version 0.49, classified under CWE-276 (Incorrect Default Permissions). This vulnerability enables attackers to access the service account's token, resulting in escalation of privileges. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.
Remote, unauthenticated attackers can exploit this flaw over the network to obtain the service account token and escalate privileges within the affected PipeCD deployment. No special access or user involvement is needed, allowing widespread potential for compromise in environments running the vulnerable version.
Mitigation details and further advisories are available in the referenced GitHub Gist at https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005, the PipeCD GitHub repository at https://github.com/pipe-cd/pipecd, and the project website at https://pipecd.dev/. Security practitioners should consult these sources for patching instructions and remediation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The remote unauthenticated vulnerability in the public-facing PipeCD service allows direct access to the service account token, enabling initial access via public-facing application exploitation (T1190) and resulting in privilege escalation (T1068).