PT-2024-24345 · Digital Bazaar · @Digitalbazaar/Zcap

Published 2024-04-10 · Updated 2024-04-10 · CVE-2024-31995

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions @digitalbazaar/zcap versions prior to 9.0.1

Description The issue arises when invoking a capability with a chain depth of 2, where the expires property is not properly checked against the current date or other date param. This can allow invocations outside of the original intended time period. However, a zcap still cannot be invoked without being able to use the associated private key material.

Recommendations For versions prior to 9.0.1, update to version 9.0.1 to fix expiration checking. As a temporary workaround, one may revoke a zcap at any time.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-31995

GHSA-HP8H-7X69-4WMV

Affected Products

@Digitalbazaar/Zcap

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31995.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31995 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31995 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hp8h-7x69-4wmv · Vendor Advisory
• https://github.com/digitalbazaar/zcap · Note
• https://github.com/digitalbazaar/zcap/security/advisories/GHSA-hp8h-7x69-4wmv · Note
• https://github.com/digitalbazaar/zcap/commit/261eea040109b6e25159c88d8ed49d3c37f8fcfe · Note
• https://github.com/digitalbazaar/zcap/commit/55f8549c80124b85dfb0f3dcf83f2c63f42532e5 · Note
• https://github.com/digitalbazaar/zcap/pull/82 · Note
• https://twitter.com/VulmonFeeds/status/1778219492285231319 · Twitter Post
• https://t.me/cvenotify/76334 · Telegram Post
• https://twitter.com/CVEnew/status/1778263591969513602 · Twitter Post