greenpau caddy-security up to 1.0.41 OAuth random values

Summaryinfo

A vulnerability identified as problematic has been detected in greenpau caddy-security up to 1.0.41. Impacted is an unknown function of the component OAuth. The manipulation leads to random values. This vulnerability is traded as CVE-2024-21495. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in greenpau caddy-security up to 1.0.41 and classified as problematic. This issue affects some unknown functionality of the component OAuth. The manipulation with an unknown input leads to a random values vulnerability. Using CWE to declare the problem leads to CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. Impacted is confidentiality. The summary by CVE is:

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

The weakness was shared 02/17/2024 as 265. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-21495 since 12/22/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 1.0.42 eliminates this vulnerability. Applying the patch ecd3725baf2683eb1519bb3c81ae41085fbf7dc2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• greenpau

Name

• caddy-security

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29
• 1.0.30
• 1.0.31
• 1.0.32
• 1.0.33
• 1.0.34
• 1.0.35
• 1.0.36
• 1.0.37
• 1.0.38
• 1.0.39
• 1.0.40
• 1.0.41

License

• open-source

Website

• Product: https://github.com/greenpau/caddy-security/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion