PT-2024-36826 · Unknown · Free-One-Api

Kexinoh · Published 2024-12-30 · Updated 2024-12-30 · CVE-2024-56516

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions free-one-api versions up to and including 1.0.1

Description The issue concerns the use of MD5, a cryptographically broken hashing algorithm, to hash passwords before sending them to the backend. This makes it vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. The free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format.

Recommendations For versions up to and including 1.0.1, consider disabling password hashing using MD5 until a secure replacement is implemented. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2024-56516

GHSA-36CC-58VM-WM4H

Affected Products

Free-One-Api

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56516.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56516 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56516 · Vendor Advisory
• https://github.com/RockChinQ/free-one-api/security/advisories/GHSA-36cc-58vm-wm4h · Note
• https://github.com/RockChinQ/free-one-api/blob/4d6ee42ffbb224b95be32c26cabc28d54d01bf78/web/src/main.js#L15 · Note
• https://twitter.com/VulmonFeeds/status/1873794366529061058 · Twitter Post
• https://twitter.com/CVEnew/status/1873773812036055313 · Twitter Post
• https://t.me/cvedetector/13939 · Telegram Post