CVE-2024-21697

published 2024-11-19

CVE-2024-21697: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. This…

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
Sourcetree for Mac 4.2: Upgrade to a release greater than or equal to 4.2.9
Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.20

See the release notes ([https://www.sourcetreeapp.com/download-archives]). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center ([https://www.sourcetreeapp.com/download-archives]).

This vulnerability was reported via our Penetration Testing program.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
atlassian	sourcetree	—	—
atlassian	sourcetree	—	—
atlassian	sourcetree	—	—
atlassian	sourcetree_for_mac	—	—
atlassian	sourcetree_for_windows	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Affected versions: Sourcetree for Mac >= 4.2.8 and Sourcetree for Windows >= 3.4.19 are vulnerable; monitor for exploitation attempts targeting these versions ↗
• → The vulnerability allows unauthenticated attackers to execute arbitrary code with user interaction required — monitor for unexpected process spawning from Sourcetree processes on Mac and Windows endpoints ↗

• · Fixed versions are Sourcetree for Mac >= 4.2.9 and Sourcetree for Windows >= 3.4.20; verify deployed versions against these thresholds ↗
• · No technical exploitation details, PoC, network indicators, or malware artifacts were disclosed in the available sources; detection opportunities are limited to version-based inventory checks and endpoint process monitoring ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.