CVE-2024-39685 — AI Deep Analysis Summary

🚨 **Essence**: Arbitrary Command Execution in Bert-VITS2. 📉 **Consequences**: Total system compromise. Attackers can run malicious OS commands, leading to data theft, modification, or destruction.…

🛡️ **CWE**: CWE-78 (OS Command Injection). 🔍 **Flaw**: The application fails to properly sanitize user inputs before passing them to system shell commands.…

🏢 **Vendor**: FishAudio. 📦 **Product**: Bert-VITS2 (Text-to-Speech model backbone). 📅 **Affected Version**: Specifically **v2.3**. 🌐 **Scope**: Open-source TTS deployments.

👑 **Privileges**: Full system access (Root/Admin equivalent). 💾 **Data**: Can read, write, or delete any file on the host server. 🕵️ **Action**: Execute arbitrary code, install backdoors, or pivot to other networks.…

🔓 **Auth**: None required (PR:N). 🌍 **Network**: Remote (AV:N). 🖱️ **UI**: None required (UI:N). 📉 **Threshold**: **LOW**. Easy to exploit remotely without authentication.…

📝 **PoC**: Yes, detailed in GHSL advisory. 🔗 **Source**: GitHub Security Lab (GHSL-2024-045). 🌐 **Public**: References provided. ⚠️ **Wild Exploit**: Likely available given the simplicity of OS command injection.…

🔍 **Check**: Inspect `webui_preprocess.py` lines 130-133 & 46-52. 🐛 **Scan**: Look for `os.system()`, `subprocess.call()`, or similar unsanitized calls.…

🔧 **Patch**: Yes, official advisory released. 📅 **Date**: July 22, 2024. 🔄 **Action**: Update to the latest version of Bert-VITS2. 📖 **Ref**: GHSL Advisory link provided. ✅ **Status**: Fix available.

🚫 **No Patch?**: Isolate the service from the internet. 🛡️ **WAF**: Block suspicious shell characters (`;`, `|`, `&`, `$`). 🧹 **Input**: Strictly validate/sanitize all TTS input parameters.…

🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: Immediate action required. 📉 **CVSS**: 9.8 (Critical). ⏳ **Time**: Patch immediately upon update availability.…