Missing Authorization Affecting goauthentik.io package, versions <2024.4.4 >=2024.6.0-rc1 <2024.6.4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOAUTHENTIKIO-7856131
- published 1 Sep 2024
- disclosed 30 Aug 2024
- credit Maor A
Introduced: 30 Aug 2024
CVE-2024-42490 Open this link in a new tabHow to fix?
Upgrade goauthentik.io to version 2024.4.4, 2024.6.4 or higher.
Overview
Affected versions of this package are vulnerable to Missing Authorization at the following endpoints:
/api/v3/crypto/certificatekeypairs/<uuid>/view_certificate//api/v3/crypto/certificatekeypairs/<uuid>/view_private_key//api/v3/.../used_by/
An attacker who can guess a UUIDv4 ID for one of the vulnerable objects at these endpoints, or compromise a privileged account to enumerate them, can expose sensitive information that can be used to further compromise the system.
Workaround
This vulnerability can be avoided by blocking access to the vulnerable endpoints using a reverse proxy.