CVE-2024-39717 — Versa Director
HIGHCVE-2024-39717 is a high-severity (CVSS 7.2) Unrestricted File Upload vulnerability in versa-networks versa director. It is in CISA's Known Exploited Vulnerabilities catalog (added 2024-08-23) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin.…
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2024-08-23. Federal agencies were required to remediate by 2024-09-13.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2024-39717.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2024-39717 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Description
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Affected Products
versa directorversa-networksResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Vendor / applianceDetect
Inventory every versa-networks versa director deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2024-39717 yet — track the versa-networks versa director advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2024-39717 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.