CVE-2024-7694

published 2024-08-12

CVE-2024-7694: ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product…

Priority P1 80 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

KEV ITW

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
teamt5	threatsonar_anti-ransomware	< 3.5.0	3.5.0
teamt5	threatsonar_anti-ransomware	<= 3.4.5	—

Detection & IOCs extracted from sources · hover to see the quote

• → Unrestricted file upload vulnerability — monitor for unexpected file uploads (especially executable or script types) via the ThreatSonar Anti-Ransomware administrator web interface ↗
• → Audit administrator-level actions on the ThreatSonar platform for anomalous file upload activity, particularly uploads that result in OS command execution ↗

• · Exploitation requires administrator privileges on the ThreatSonar platform — attack surface is limited to authenticated admin accounts, but lateral movement or credential compromise could enable exploitation ↗
• · Vendor advisory and TWCERT notice are available; apply mitigations per vendor instructions or discontinue use if mitigations are unavailable ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vulncheck 7.2 HIGH

cisa 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434