PT-2024-21647 · Ckan · Ckan

Zuhairorzaki · Published 2024-03-13 · Updated 2024-03-14 · CVE-2024-27097

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.11 CKAN versions prior to 2.10.4

Description A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. The issue is related to the /user/reset endpoint and the id parameter.

Recommendations For CKAN versions prior to 2.9.11, upgrade to version 2.9.11 or later. For CKAN versions prior to 2.10.4, upgrade to version 2.10.4 or later. As a temporary workaround for users unable to upgrade, override the "/user/reset" endpoint to filter the id parameter in order to exclude newlines.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

CWE-117

Related Identifiers

CVE-2024-27097

GHSA-8G38-3M6V-232J

Affected Products

Ckan

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27097.json · Exploit
• https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c · Patch
• https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27097 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g38-3m6v-232j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27097 · Security Note
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/commit/d81f411bff2da7347c343a83e17f5814475b5b64 · Note
• https://github.com/ckan/ckan/commit/5fa133e7e9019573066455b5d442e93c62b3fc93 · Note
• https://docs.ckan.org/en/2.10/changelog.html#v-2-10-4-2024-03-13 · Note
• https://twitter.com/CVEnew/status/1768213803379155124 · Twitter Post