PT-2025-6098 · Perfood · Couch-Auth

William Tantiono · Publicado 2025-02-10 · Atualizado 2025-02-12 · CVE-2024-57177

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions perfood/couch-auth versions <= 0.21.2

Description A host header injection vulnerability exists in the NPM package of perfood/couch-auth. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a Server-Side Template Injection (SSTI) which can be leveraged to run limited commands or leak server-side information.

Recommendations For perfood/couch-auth versions <= 0.21.2, consider disabling the email change confirmation feature until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the host header in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Enumeração de Fraquezas

CWE-1336

CWE-74

Identificadores relacionados

CVE-2024-57177

GHSA-R385-C5FC-X56C

Produtos afetados

Couch-Auth

Referências · 8

• 🔥 https://github.com/waristea/cve-research/tree/main/CVE-2024-57177 · Exploit
• https://github.com/perfood/couch-auth · Nota
• https://twitter.com/VulmonFeeds/status/1889148344544493870 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1889740120300847597 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-57177 · Nota de Segurança
• https://t.me/cvedetector/17607 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1889032560149213436 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-57177 · Aviso do Fabricante