PT-2024-29340 · Casdoor · Casdoor

Yuexi Zhang · CVE-2024-41264 · Published 2024-08-01 · Updated 2024-08-16

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions casdoor version 1.636.0

Description An issue in casdoor allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method, which disables host key verification. This method is used in github.com/casdoor/casdoor.

Recommendations For casdoor version 1.636.0, consider disabling the use of the ssh.InsecureIgnoreHostKey() method to prevent host key verification bypass until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Information Disclosure

Weakness Enumeration

CWE-295

CWE-200

CWE-297

Related Identifiers

CVE-2024-41264

GHSA-67FW-W8F2-88WP

GO-2024-3026

Affected Products

Casdoor

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41264.json · Exploit
• https://osv.dev/vulnerability/GO-2024-3026 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67fw-w8f2-88wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41264 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41264 · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go · Note
• https://pkg.go.dev/vuln/GO-2024-3026 · Note
• https://t.me/cvedetector/2251 · Telegram Post
• https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f · Note
• https://t.me/cvenotify/88262 · Telegram Post
• https://github.com/advisories/GHSA-67fw-w8f2-88wp · Note
• https://t.me/cvenotify/90935 · Telegram Post