PT-2024-31400 · Nixos · Hydra

Delroth · Published 2024-08-27 · Updated 2024-08-31 · CVE-2024-45049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hydra (affected versions not specified)

Description Hydra is a Continuous Integration service for Nix-based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems.

Recommendations To fix the issue, apply the patch from https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package and upgrade. As a temporary workaround for users unable to upgrade, deny the "/api/push" route in a reverse proxy, noting that this will also break the "Evaluate jobset" button in the frontend.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-45049

GHSA-XV29-V93R-2F5V

Affected Products

Hydra

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45049.json · Exploit
• https://github.com/NixOS/nixpkgs/pull/337766 · Patch
• https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 · Patch
• https://github.com/NixOS/hydra/security/advisories/GHSA-xv29-v93r-2f5v · Patch
• https://osv.dev/vulnerability/CVE-2024-45049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45049 · Security Note
• https://twitter.com/CVEnew/status/1828533330607853791 · Twitter Post
• https://t.me/cvedetector/4283 · Telegram Post
• https://twitter.com/cracbot/status/1829761203226190113 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1828563509468115007 · Twitter Post
• https://twitter.com/cracbot/status/1830123515984613661 · Twitter Post
• https://mastodon.delroth.net/@delroth/113029832631860419 · Note