PT-2024-27815 · Unknown · Firefly-Iii

Skelmis · Published 2024-06-17 · Updated 2026-06-16 · CVE-2024-37893

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefly III versions prior to 6.1.17

Description An MFA bypass exists in the OAuth flow of Firefly III, which allows malicious users to circumvent the multi-factor authentication check. This flaw enables attackers to use password spraying—a technique where common passwords are tried against many accounts—to gain access to data using credentials stolen from other sources. Because OAuth applications use an incrementing ID, they are easily enumerable, allowing an attacker to potentially register an OAuth application to a user's profile. Successful exploitation requires the attacker to possess the victim's username and password.

Recommendations Update to version 6.1.17 or later. Use a unique password for the instance and store it securely in a password manager.

Exploit

Fix

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2024-37893

GHSA-4GM4-C4MH-4P7W

Affected Products

Firefly-Iii

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37893.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37893 · Security Note
• https://osv.dev/vulnerability/GHSA-4gm4-c4mh-4p7w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37893 · Vendor Advisory
• https://github.com/firefly-iii/firefly-iii · Note
• https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-4gm4-c4mh-4p7w · Note
• https://owasp.org/www-community/attacks/Password_Spraying_Attack · Note
• https://twitter.com/BRuteLogic/status/2066687203611484267 · Twitter Post
• https://menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass · Note