Yeti - RCE (CVE-2024-46507)
Description
Yeti is affected by an SSTI that can lead to an RCE.
psychologyCrowdSec Analysis
CVE-2024-46507 is a vulnerability in Yeti that exposes systems to server-side template injection, potentially allowing remote code execution if exploited.
CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-46507 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2024-46507 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2024-46507 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Attack patterns generally focus on requests to URLs containing /api/v2/templates.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-01-29 |
| Rule Released | 2025-03-05 |
| CrowdSec First Seen | 2025-03-06 |
Related Weaknesses
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.