{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/genie-4.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netflix:genie:4.3.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2024-4701"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Genie (4.3.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Netflix"],"content_html":"\u003cp\u003eNetflix Genie version 4.3.0 is affected by a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-4701. The vulnerability stems from an insecure file upload mechanism that permits the placement of malicious shared library files within the application's environment. Attackers can leverage this flaw to upload custom shared objects (.so files) and auxiliary configuration files. The execution is deferred until a user performs an interactive login into the Genie application container, at which point the application environment processes the uploaded library. This vulnerability carries a CVSS score of 9.9, and a publicly available proof-of-concept (PoC) exploit confirms the ease of execution. Defenders should prioritize patching or restricting access to the Genie administrative interface, as successful exploitation results in full code execution within the container context.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies the Genie administrative interface on the network.\u003c/li\u003e\n\u003cli\u003eThe attacker prepares a malicious payload consisting of a shared library (e.g., pe.so) and associated upload manifest files.\u003c/li\u003e\n\u003cli\u003eThe attacker performs an unauthorized HTTP POST request to the Genie file upload endpoint, transmitting the malicious binary.\u003c/li\u003e\n\u003cli\u003eThe Genie application stores the malicious files within the containerized file system.\u003c/li\u003e\n\u003cli\u003eThe attacker or an administrator initiates an interactive session into the container using the 'docker exec' command.\u003c/li\u003e\n\u003cli\u003eThe Genie application environment, during the user authentication or login process, dynamically loads the malicious library.\u003c/li\u003e\n\u003cli\u003eThe arbitrary code within the library executes with the privileges of the Genie process.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves persistence or objective completion, evidenced in the PoC by writing command output to the /tmp directory.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-4701 allows an attacker to achieve remote code execution on the underlying container. This facilitates full system compromise, data exfiltration, and potential lateral movement within the containerized environment. Given the 9.9 CVSS rating and the availability of a functional PoC, organizations deploying Netflix Genie 4.3.0 face a high risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict network access to the Genie management API and administrative interfaces to trusted management subnets only.\u003c/li\u003e\n\u003cli\u003eMonitor file integrity within the Genie container environment, specifically looking for new .so or binary files appearing in application directories.\u003c/li\u003e\n\u003cli\u003eAudit all active docker containers for unexpected 'docker exec' sessions.\u003c/li\u003e\n\u003cli\u003eUpgrade Netflix Genie to a version beyond 4.3.0 or apply vendor-supplied patches as they become available to remediate the insecure upload vector.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T18:04:05Z","date_published":"2026-10-15T18:04:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netflix-genie-rce/","summary":"CVE-2024-4701 is a critical remote code execution vulnerability in Netflix Genie 4.3.0, enabling attackers to execute arbitrary code by uploading a malicious shared library that triggers upon container login.","title":"Remote Code Execution in Netflix Genie via Malicious Library Upload","url":"https://feed.craftedsignal.io/briefs/2026-10-netflix-genie-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Genie (4.3.0)","version":"https://jsonfeed.org/version/1.1"}