PT-2024-17207 · Ctfd · Ctfd

Blazej Adamczyk + 2 · Published 2024-12-31 · Updated 2025-01-03 · CVE-2024-11717

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CTFd versions prior to 3.7.5

Description The issue concerns tokens used for account activation and password resetting in CTFd, which can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and are not single use. This means that during the token expiration time, an on-path attacker might reuse such a token to change a user's password and take over the account. Moreover, the tokens also include the user's email encoded in base64.

Recommendations For versions prior to 3.7.5, update to version 3.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the account activation and password resetting features until the update is applied. Additionally, users should be cautious when using these features and monitor their account activity for any suspicious behavior.

Exploit

Fix

Weakness Enumeration

CWE-837

CWE-1391

Related Identifiers

CVE-2024-11717

Affected Products

Ctfd

References · 11

• 🔥 https://seclists.org/fulldisclosure/2024/Dec/21 · Exploit
• https://github.com/CTFd/CTFd/pull/2679 · Patch
• https://blog.ctfd.io/ctfd-3-7-5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11717 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11717 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1874009565366280457 · Twitter Post
• https://ctfd.io · Note
• http://seclists.org/fulldisclosure/2024/Dec/21 · Note
• https://t.me/cvedetector/14186 · Telegram Post
• https://cert.pl/en/posts/2025/01/CVE-2024-11716 · Note
• https://twitter.com/CVEnew/status/1875033743401873864 · Twitter Post