High severity · published May 27, 2024
CVE-2024-34477
configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure)
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fogproject · Fogproject
before 1.5.10.41 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34477
Exploit
https://blog.hackvens.fr/advisories/CVE-2024-34477-Fogproject.html
Exploit
https://forums.fogproject.org/topic/17486/fog-1-5-10-and-earlier-nfs-privilege-escalation-vulnerability
Product
https://github.com/FOGProject/fogproject/blob/a4bb1bf39ac53c3cbe623576915fbc3b5c80a00f/lib/common/functions.sh#L1360
More from Fogproject
9.8
CVE-2024-39914
FOG is a cloning/imaging/rescue suite/inventory management system
9.1
CVE-2025-58443
FOG's authentication bypass leads to full SQL DB dump
8.8
CVE-2026-116778
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
8.8
CVE-2024-40645
FOG is a cloning/imaging/rescue suite/inventory management system
8.8
CVE-2021-32243
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated)