PT-2024-35447 · Unknown · Password Pusher

Published 2024-10-14 · Updated 2024-11-21 · CVE-2024-52796

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Password Pusher versions prior to v1.49.0

Description The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially causing a denial of service. This also enables attackers to more easily execute brute force attacks.

Recommendations For versions prior to v1.49.0, upgrade to at least v1.49.0 to mitigate this risk. As a temporary workaround, add rules to your proxy and/or firewall to not accept external proxy headers such as X-Forwarded-* from clients. If you are running a remote proxy, authorize the IP address of your remote proxy according to the documentation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-521

Related Identifiers

BDU:2025-01263

CVE-2024-52796

GHSA-FFP2-8P2H-4M5J

Affected Products

Password Pusher

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52796.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pwpush/CVE-2024-52796.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52796 · Security Note
• https://bdu.fstec.ru/vul/2025-01263 · Security Note
• https://osv.dev/vulnerability/GHSA-ffp2-8p2h-4m5j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52796 · Vendor Advisory
• https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0 · Note
• https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j · Note
• https://github.com/pglombardo/PasswordPusher · Note
• https://twitter.com/CVEnew/status/1859451951726899245 · Twitter Post
• https://twitter.com/rubylandnews/status/1859708437900259378 · Twitter Post
• https://twitter.com/pwpush/status/1859291598997135509 · Twitter Post
• https://docs.pwpush.com/docs/proxies/#trusted-proxies · Note
• https://twitter.com/VulmonFeeds/status/1859382929064866042 · Twitter Post
• https://t.me/cvedetector/11623 · Telegram Post