PT-2024-37073 · Simofa · Simofa

Truewinter · Published 2024-12-30 · Updated 2025-01-04 · CVE-2024-56799

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Simofa versions prior to 0.2.7

Description Simofa is a tool to help automate static website building and deployment. Due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication.

Recommendations For versions prior to 0.2.7, upgrade to version 0.2.7 to resolve the issue. As a temporary workaround, consider restricting access to sensitive API routes until the upgrade is applied.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-56799

GHSA-83QW-5QQ5-V7PQ

Affected Products

Simofa

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56799.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-56799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56799 · Security Note
• https://twitter.com/VulmonFeeds/status/1873850702176383255 · Twitter Post
• https://t.me/cvedetector/13948 · Telegram Post
• https://twitter.com/CVEnew/status/1873802149563429277 · Twitter Post
• https://twitter.com/CveFindCom/status/1873799766909301058 · Twitter Post
• https://github.com/TrueWinter/simofa/security/advisories/GHSA-83qw-5qq5-v7pq · Note
• https://t.me/cvenotify/105781 · Telegram Post
• https://twitter.com/cracbot/status/1875421971133166077 · Twitter Post
• https://t.me/latest_high_impact_cve/1731 · Telegram Post
• https://github.com/TrueWinter/simofa/commit/1b04ba413a9c1d12a33dd50a32f67345c2fa6f2a · Note