Summary

The BitBake Toaster server in the Yocto Project fails to validate input before passing it to the server’s shell. A remote attacker can achieve OS command execution via a crafted HTTP request, without authentication. Toaster is an optional web interface and is not used by default command-line BitBake builds.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — 8.8 High (vendor advisory).

Note: NVD/NIST rescored this 9.8 Critical (UI:N instead of UI:R).

Details

Toaster incorporates attacker-controlled values from an HTTP request into a command that reaches the system shell without neutralizing shell metacharacters (CWE-78). Because the input is not sanitized or safely parameterized, an attacker can inject additional commands that run with the privileges of the Toaster process. No authentication is required to reach the affected functionality.

Impact

Remote code execution on the host running Toaster, with the privileges of the Toaster process. Exposure is limited to deployments that actually run the optional Toaster interface, so default CLI builds are unaffected.

Remediation

  • Upgrade to a fixed release: Yocto Project 3.1.31, 4.0.16, or 4.3.2 (BitBake 2.6.2) or later.
  • If you cannot upgrade immediately, do not expose the Toaster interface to untrusted networks.

Disclosure Timeline

  • 2024-02-19 — Published (CVE-2024-25626 / GHSA-75xw-78mm-72r4).

References