Authentication Bypass Affecting github.com/oragono/oragono/irc Open this link in a new tab package, versions >=2.4.0-rc1 <2.6.1
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMORAGONOORAGONOIRC-1255639
-
published
26 Apr 2021
-
disclosed
26 Apr 2021
-
credit
@ajaspers
Introduced: 26 Apr 2021
CWE-287 Open this link in a new tabHow to fix?
Upgrade github.com/oragono/oragono/irc
to version 2.6.1 or higher.
Overview
github.com/oragono/oragono/irc is a modern, experimental IRC server written in Go.
Affected versions of this package are vulnerable to Authentication Bypass via the REGISTER
command. The REGISTER
command was allowed before connection registration, allowing unauthenticated users to REGISTER
and then take advantage of skip-server-password
.
The main vulnerability here is for configurations that enable server.password
(not a default) and leave accounts.registration.allow-before-connect
enabled (a default). The issue appears to have originated in v.2.4.0-rc1.