PT-2024-29971 · Unknown · Oauth Library For Nim

Rikaardhosein · Published 2024-08-15 · Updated 2024-08-19 · CVE-2024-42475

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OAuth library for nim versions prior to 0.11

Description The state values generated by the generateState function do not have sufficient entropy, allowing an attacker to guess them and perform a CSRF attack, associating the user's session with the attacker's protected resources. The generateState function should use a cryptographically secure pseudorandom number generator (CSPRNG) to generate state values. The issue is resolved in version 0.11, which generates state values with at least 128 bits of entropy using a CSPRNG.

Recommendations For versions prior to 0.11, update to version 0.11 to resolve the issue, as it modifies the generateState function to generate state values with sufficient entropy using a CSPRNG. As a temporary workaround, consider using a CSPRNG to generate state values until the update to version 0.11 is applied.

Exploit

Fix

Use of Insufficiently Random Values

CSRF

Weakness Enumeration

CWE-330

CWE-352

Related Identifiers

CVE-2024-42475

GHSA-332C-Q46H-FG8F

Affected Products

Oauth Library For Nim

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42475.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-42475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42475 · Security Note
• https://github.com/CORDEA/oauth/security/advisories/GHSA-332c-q46h-fg8f · Note
• https://github.com/CORDEA/oauth/blob/b8c163b0d9cfad6d29ce8c1fb394e5f47182ee1c/src/oauth2.nim#L179 · Note
• https://t.me/cvedetector/3276 · Telegram Post
• https://twitter.com/CVEnew/status/1824156941423120690 · Twitter Post
• https://t.me/cvenotify/91112 · Telegram Post