PT-2024-22329 · Unknown · Yourspotify

Ragingcactus · Published 2024-03-13 · Updated 2024-03-13 · CVE-2024-28195

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YourSpotify versions prior to 1.9.0

Description The issue affects the API and login flow of YourSpotify, allowing attackers to execute Cross-Site Request Forgery (CSRF) attacks. This enables them to retrieve, modify, or delete data on the affected instance. Additionally, repeated CSRF attacks can lead to the creation of a new user and promotion to instance administrator if a legitimate administrator visits a malicious website. The exploitability of this issue depends on the victim's browser version and settings.

Recommendations For versions prior to 1.9.0, upgrade to version 1.9.0 to address the issue. As a temporary workaround, consider restricting access to the API and login flow until the upgrade is applied. Note that there are no known workarounds for this issue, and upgrading to the fixed version is the recommended resolution.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-28195

GHSA-HFGF-99P3-6FJJ

Affected Products

Yourspotify

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28195.json · Exploit
• https://github.com/Yooooomi/your_spotify/commit/c3ae87673910c9903bb53088c8b71ed2c9aa54e4 · Patch
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-hfgf-99p3-6fjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28195 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28195 · Vendor Advisory
• https://twitter.com/CVEnew/status/1767965839666389498 · Twitter Post