{"id":"CVE-2024-3955","kind":"vulnerability","aliases":["CVE-2024-3955","GHSA-4f92-w438-f484"],"related":[],"title":"CraftBeerPi 4 allows arbitrary code execution","description":"URL GET parameter \"logtime\" utilized within the \"downloadlog\" function from \"cbpi/http_endpoints/http_system.py\" is subsequently passed to the \"os.system\" function in \"cbpi/controller/system_controller.py\" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).","summary":"CraftBeerPi 4 passes the logtime URL parameter of its downloadlog endpoint straight into os.system without validation. An attacker who can send a crafted request can run arbitrary operating system commands on the host.","severity":"critical","cvss":9.8,"epss":0.01149,"exploited":false,"exploited_at":null,"products":[{"name":"cbpi4","fixed":["4.4.1.a1"],"affected":">= 4.0.0.58, < 4.4.1.a1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-94","package","pypi","python","raspberry-pi","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `pip show cbpi4` and confirm the installed version is below `4.4.1.a1` and at least `4.0.0.58`\n- Check whether the web interface is reachable from untrusted networks, since the endpoint is served by the CraftBeerPi HTTP server","fix":"- Upgrade the `cbpi4` PyPI package to `4.4.1.a1` or later\n- Until upgraded, block external access to the CraftBeerPi web port","status":"open","published_at":"2024-05-02T10:15:08+00:00","first_seen_at":"2026-10-27T16:25:43+00:00","triaged_at":"2026-10-27T16:27:40+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:27:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `cbpi4` PyPI package to `4.4.1.a1` or later\n- Until upgraded, block external access to the CraftBeerPi web port","reach":"network","title":"CraftBeerPi 4: unvalidated log time parameter lets a request run code","impact":"high","summary":"CraftBeerPi 4 passes the logtime URL parameter of its downloadlog endpoint straight into os.system without validation. An attacker who can send a crafted request can run arbitrary operating system commands on the host.","category":"package","nicknames":[],"who_cares":["python","pypi","self-hosted","raspberry-pi"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the device","analyst_note":"","how_to_check":"- Run `pip show cbpi4` and confirm the installed version is below `4.4.1.a1` and at least `4.0.0.58`\n- Check whether the web interface is reachable from untrusted networks, since the endpoint is served by the CraftBeerPi HTTP server","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Any deployment of the cbpi4 PyPI package from 4.0.0.58 up to but not including 4.4.1.a1 is exposed, most often Raspberry Pi brewing controllers running the web interface. Installations on versions outside that range, or not reachable over the network, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000614,"input_tokens":3419,"output_tokens":545,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':8A,16A '-3955':9A,17A '-94':20B '4':2A,31B,94C '4.0.0.58':96C '4.4.1':100C '4f92':12A '563fae9':98C '57572c7':103C 'a1':101C 'affect':92C 'allow':3A,86C 'arbitrari':4A,56B,87C 'attack':47B 'cbpi/controller/system_controller.py':82C 'cbpi/http_endpoints/http_system.py':73C 'cbpi4':18A 'code':5A,88C 'command':59B 'commit':97C,102C 'craft':52B 'craftbeerpi':1A,30B,93C 'cve':7A,15A 'cwe':19B 'downloadlog':39B,70C 'endpoint':40B 'execut':6A,89C 'f484':14A 'function':71C,80C 'get':64C 'ghsa':11A 'ghsa-4f92-w438-f484':10A 'host':29B,62B 'issu':91C 'logtim':34B,66C 'oper':57B 'os.system':43B,79C 'packag':21B 'paramet':36B,65C 'pass':32B,76C 'pi':26B 'prior':84C 'pypi':22B 'python':23B 'raspberri':25B 'raspberry-pi':24B 'request':53B 'run':55B 'self':28B 'self-host':27B 'send':50B 'straight':41B 'subsequ':75C 'system':58B 'url':35B,63C 'util':67C 'valid':45B,85C 'w438':13A 'within':68C 'without':44B,83C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the cbpi4 PyPI package from 4.0.0.58 up to but not including 4.4.1.a1 is exposed, most often Raspberry Pi brewing controllers running the web interface. Installations on versions outside that range, or not reachable over the network, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-02T10:15:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4f92-w438-f484","url":"https://github.com/advisories/GHSA-4f92-w438-f484","severity":"critical","published_at":"2024-05-02T12:30:40+00:00","modified_at":"2026-10-27T16:20:49+00:00","first_seen_at":"2026-10-27T16:25:43+00:00","fetched_at":"2026-10-27T16:25:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-3955","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3955","severity":null,"published_at":"2024-05-02T10:15:08+00:00","modified_at":"2026-06-17T07:45:32+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}