RockChinQ free-one-api up to 1.0.1 weak hash

Summaryinfo

A vulnerability was found in RockChinQ free-one-api up to 1.0.1. It has been rated as problematic. This impacts an unknown function. The manipulation leads to weak hash. This vulnerability is listed as CVE-2024-56516. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in RockChinQ free-one-api up to 1.0.1. This issue affects an unknown function. The manipulation with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is confidentiality. The summary by CVE is:

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-56516 since 12/26/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• RockChinQ

Name

• free-one-api

Version

• 1.0.0
• 1.0.1

Website

• Product: https://github.com/RockChinQ/free-one-api/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion