External risk intelligence

Aliyundrive-WebDAV Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-29640

The product is a WebDAV server, which is inherently designed to provide network-accessible file sharing and storage services. Such services are commonly exposed to the internet or accessible as edge services to allow remote file access and synchronization, making public or external network reachability a standard deployment pattern for this type of application.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability affecting the aliyundrive-webdav component, specifically in how it processes requests related to QR code queries. The flaw permits remote attackers to execute unauthorized code by sending a specially crafted request. Understanding the nature of this vulnerability and its potential reach is important for assessing organizational risk.

Remote code execution via QR code query flaw.
Potential for unauthorized code execution exists.
Confirm relevance and verify exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending a specially crafted request over the network to the aliyundrive-webdav service. If successful, this could lead to the attacker executing arbitrary code on the affected system.

Network access required.
Vulnerable `sid` parameter in `action_query_qrcode`.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the aliyundrive-webdav component could permit a remote attacker to execute arbitrary code. This could occur through a specifically crafted payload targeting the `sid` parameter within the `action_query_qrcode` function. When this vulnerability is exploited, an attacker might gain control over the affected system, potentially leading to unauthorized access or manipulation of data.

Remote code execution.
Crafted payload to `sid` parameter.
System compromise and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in aliyundrive-webdav affects the `action_query_qrcode` component, potentially allowing remote code execution. Infrastructure and platform teams are likely responsible for managing this WebDAV server. The immediate first step is to identify all instances of aliyundrive-webdav, confirm their network exposure and business criticality, and then coordinate with the accountable owner for remediation planning based on risk.

Own by infrastructure and platform teams.
Verify network exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is aliyundrive-webdav?

Aliyundrive-webdav is a software utility that acts as a bridge, allowing users to mount Aliyundrive cloud storage as a local WebDAV drive. By implementing the WebDAV protocol, it enables standard file management operations—like opening, saving, and syncing files—across various applications as if the cloud data were stored directly on the local machine or network.

What does CWE-78 mean for CVE-2024-29640?

CWE-78 refers to Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. In the context of CVE-2024-29640, it means the software fails to properly sanitize input provided to the application. Because of this, an attacker can insert their own system-level commands into the data, tricking the server into running those commands with the privileges of the application.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending a specially crafted request to the WebDAV service. Specifically, they target the 'sid' parameter within the 'action_query_qrcode' component. It is important to note that this requires a network connection to the service; the bug is not triggered by typical file access operations or standard WebDAV traffic, but rather by malformed input sent specifically to that QR code query function.

Is my aliyundrive-webdav instance at risk?

If you are running versions 2.3.3 or earlier, you are potentially at risk. According to Halo Surface Signal, this software is a WebDAV server, which is inherently designed to be networked for remote file access. Because these services are frequently placed at the edge of a network to allow cloud synchronization, there is a higher probability that your instance is reachable by external parties, increasing the potential impact.

What steps should I take to respond to this CVE?

Start by identifying every instance of aliyundrive-webdav running in your environment. Once you have a list, verify if those instances are accessible via the network and assess how critical they are to your daily operations. Coordinate with your technical teams to determine if you can restrict access to these services or plan for an update to a version that addresses this flaw, prioritizing based on the risk to your infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.