CVE-2024-0195

published 2024-01-02

CVE-2024-0195: A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file…

Priority P2 76 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ssssssss	spider-flow	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /function/save↗

command id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+{{interactsh-url}}')%3B%7B↗

path src/main/java/org/spiderflow/controller/FunctionController.java↗

• → Detect exploitation attempts by monitoring POST requests to /function/save containing Java.type or Runtime.getRuntime().exec() in the 'script' parameter body. ↗
• → SpiderFlow instances can be fingerprinted via FOFA queries; look for the string 'SPIDER_FLOW_VERSION' in HTTP responses to identify exposed targets. ↗
• → The exploit requires no authentication (PR:N); any unauthenticated POST to /function/save with a crafted 'script' field should be treated as a high-confidence attack indicator. ↗
• → Use FOFA queries 'app="SpiderFlow"' or 'app="spiderflow"' to identify internet-exposed SpiderFlow instances for proactive patching or monitoring. ↗

• · The vulnerability affects specifically spider-flow version 0.4.3; the exploit targets the FunctionService.saveFunction method via the /function/save endpoint. ↗
• · The Nuclei template uses a two-step flow: first confirming the SpiderFlow fingerprint (SPIDER_FLOW_VERSION in response), then sending the exploit payload — detections should mirror this two-stage confirmation to reduce false positives. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94