PT-2024-29665 · Bostr · Bostr

Cxplay · Published 2024-08-01 · Updated 2024-08-16 · CVE-2024-41962

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bostr versions prior to 3.0.10

Description The issue allows unauthorized access to a private bouncer, even when authorized keys are set, if noscraper is enabled. This means that anyone can use the bouncer, regardless of whether their pubkey is in authorized keys.

Recommendations For versions prior to 3.0.10, update to version 3.0.10 to resolve the issue. As a temporary workaround, consider disabling the noscraper option if authorized keys is set in the config.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-41962

GHSA-5CF7-CXRF-MQ73

Affected Products

Bostr

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41962.json · Exploit
• https://github.com/Yonle/bostr/commit/49181f4ec9ae1472c6675cab56bbc01e723855af · Patch
• https://github.com/Yonle/bostr/security/advisories/GHSA-5cf7-cxrf-mq73 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41962 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41962 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5cf7-cxrf-mq73 · Vendor Advisory
• https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21 · Note
• https://github.com/Yonle/bostr · Note
• https://github.com/Yonle/bostr/releases/tag/3.0.10 · Note
• https://t.me/cvenotify/88524 · Telegram Post
• https://t.me/cvedetector/2254 · Telegram Post
• https://t.me/cvenotify/90958 · Telegram Post
• https://t.me/cvenotify/88278 · Telegram Post