PT-2024-20534 · Crafatar · Crafatar

J-295 · Published 2024-02-01 · Updated 2024-02-09 · CVE-2024-24756

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crafatar versions prior to 2.1.5

Description Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the lib/public/ directory can be requested from the server. Instances running behind Cloudflare, including crafatar.com, are not affected. However, instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential.

Recommendations For versions prior to 2.1.5, update to version 2.1.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files outside of the lib/public/ directory until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-24756

GHSA-5CXQ-25MP-Q5F2

Affected Products

Crafatar

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24756.json · Exploit
• 🔥 https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2 · Exploit
• https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373 · Patch
• https://osv.dev/vulnerability/CVE-2024-24756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24756 · Security Note
• https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67 · Note
• https://twitter.com/CVEnew/status/1753189608832000380 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1753234163530928637 · Twitter Post
• https://t.me/cvenotify/70876 · Telegram Post