CVE-2024-38887

The vulnerability results from executing system commands with unnecessary (redundant) privileges in the database context. An attacker can remotely, over the network, pass malicious input data that is passed to the system shell without proper validation or sanitization. As a result, it is possible to break out of the database context and take control of the server's operating system.

An attacker can gain full control over the operating system of the server running Caterease, enabling data read, modification or deletion, as well as further actions within the victim's infrastructure (lateral movement).

Apply patches available from the vendor according to references. It is recommended to restrict network access to the Caterease server exclusively to trusted hosts (firewall, network segmentation) and review the permissions under which the database service operates to apply the principle of least privilege.

Horizoncloud Caterease in versions from 16.0.1.1663 to 24.0.1.2405 inclusive, and possibly later versions as well.