External risk intelligence

SequenceServer Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-42360

SequenceServer is designed to set up a BLAST+ server for personal or group use. While it provides a web-based user interface and HTTP endpoints that can be deployed for research collaboration, it is not typically an internet-facing edge service or public gateway by default. Its deployment is often internal or within limited research networks, making public internet exposure possible but not the standard expectation for all installations.

Wurmlab Sequenceserver

before 3.1.2

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SequenceServer, a tool used for setting up BLAST+ servers with a user interface. The issue allows for the injection and execution of unwanted shell commands due to improper handling of user input in certain HTTP endpoints. This could potentially impact the integrity and availability of systems running this software.

Unsanitized input allows command execution.
Potential for unauthorized system access.
Confirm relevance and exposure for SequenceServer.

Attack Path

How an attacker could exploit the issue

An attacker could reach SequenceServer through its network-accessible HTTP endpoints without needing any special privileges or user interaction. By sending specially crafted input to certain endpoints, an attacker could trick the server into executing arbitrary shell commands, potentially leading to the compromise of the server and its data.

No authentication or user interaction needed.
Exploited via HTTP endpoints with malformed input.
Risk of command execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to inject and execute arbitrary shell commands on the SequenceServer system. This could affect the integrity and availability of the server and any data it manages.

System commands and server integrity.
Unsanitized HTTP endpoints.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure or platform teams are likely responsible for addressing this vulnerability in SequenceServer, as it involves custom applications and their underlying environments. The first practical step is to identify all instances of SequenceServer, confirm their accessibility and business criticality, and then determine the specific owner responsible for remediation. Planning should then follow based on the assessed risk and impact.

Identify SequenceServer instances and owners.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SequenceServer and how is it used?

SequenceServer is a software tool created by wurmlab that simplifies the setup of BLAST+ servers. Researchers and biologists use it to provide an intuitive web-based interface for sequence similarity searches, often within group or laboratory environments where they need to compare genetic or protein data against local or custom databases.

What does command injection mean for CVE-2024-42360?

This vulnerability is classified as CWE-77, or Improper Neutralization of Special Elements used in an OS Command. In plain English, the software fails to properly clean data sent by users before processing it. This weakness allows an attacker to insert malicious system commands into the input, which the server then accidentally executes with its own permissions.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted input through specific HTTP endpoints managed by the software. It is important to note that the vulnerability does not require authentication or any prior interaction from a legitimate user to initiate the malicious command execution; the flaw exists simply because the application does not validate the input.

Do I need to worry if my SequenceServer is internal?

Halo Surface Signal indicates that while SequenceServer is often deployed within limited research networks, its web interface makes public exposure possible. If your instance is accessible via the internet, the risk is higher. You should assess where your specific deployment resides relative to your network perimeter to determine if it is reachable by unauthorized parties.

How do I respond to this vulnerability?

The first step is to locate all active instances of SequenceServer in your environment and identify the teams responsible for them. Once you have a complete inventory, prioritize updating to version 3.1.2 or later, as this release contains the necessary fixes. Consult your system owners to verify the upgrade path and ensure no other business-critical processes are affected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.