PT-2024-22327 · Spotify · Yourspotify

Ragingcactus · Published 2024-03-13 · Updated 2024-03-15 · CVE-2024-28193

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions YourSpotify versions prior to 1.8.0

Description The issue allows attackers with access to a public token for guest access to obtain Spotify API tokens of users. This can lead to the extraction of profile information, listening habits, playlists, and other data from the corresponding Spotify profile. Additionally, attackers can control playback in the Spotify app.

Recommendations For versions prior to 1.8.0, upgrade to version 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the /me API endpoint until the upgrade is applied. Avoid using the public token feature in the settings until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-28193

GHSA-3782-758F-MJ85

Affected Products

Yourspotify

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28193.json · Exploit
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-3782-758f-mj85 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28193 · Security Note
• https://twitter.com/RedPacketSec/status/1768579978721914969 · Twitter Post
• https://twitter.com/CVEnew/status/1768010506307051823 · Twitter Post