Loading vulnerability…
CVE-2024-32462 is a sandbox escape in Flatpak versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8. A Flatpak application can supply an arbitrary command line to the org.freedesktop.portal.Background.RequestBackground portal method. Flatpak transforms this command line into a flatpak run invocation using the --command option. Because the value is not delimited before reaching Bubblewrap, an attacker can cause Bubblewrap options, including filesystem bind-mount options, to be interpreted as arguments rather than as the application command. This permits execution outside the intended Flatpak sandbox.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept exploit for CVE-2024-32462, targeting Flatpak on Linux (specifically with org.freedesktop.Platform 21.08). The exploit demonstrates a sandbox escape by abusing the org.freedesktop.portal.Background D-Bus interface. The main payload is a Python script (exploit.py) that requests background access via D-Bus, passing a crafted commandline to bind the host root filesystem (/) into the Flatpak sandbox at /hostroot. It then lists the contents of /hostroot and reads /hostroot/etc/passwd, demonstrating access to files outside the sandbox. The repository includes a Flatpak manifest (org.exploit.SandboxEscape.yaml) to build and install the exploit as a Flatpak app, and a .desktop file for integration. The attack vector is local, requiring the user to run the Flatpak app. The exploit does not provide a remote shell or persistent access, but demonstrates the ability to escape the Flatpak sandbox and access host files.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.