PT-2024-28051 · Hush Line · Hush Line

Lsd-Cat · Published 2024-06-27 · Updated 2024-06-28 · CVE-2024-38523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hush Line versions prior to 0.10

Description The issue concerns the TOTP authentication flow in Hush Line, which has multiple weaknesses that undermine its one-time nature. Specifically, the lack of 2FA for changing security settings allows an attacker with CSRF or XSS primitives to alter these settings without requiring user interaction or credentials.

Recommendations For versions prior to 0.10, update to version 0.10 to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-38523

GHSA-4C38-HHXX-9MHX

Affected Products

Hush Line

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38523.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38523 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38523 · Vendor Advisory
• https://github.com/scidsg/hushline/security/advisories/GHSA-4c38-hhxx-9mhx · Note
• https://github.com/scidsg/hushline/pull/376 · Note