Lucene search

GitHub Advisory DatabaseGHSA-5CF7-CXRF-MQ73

HistoryAug 02, 2024 - 1:20 a.m.

Bostr Improper Authorization vulnerability

2024-08-0201:20:13

CWE-285

GitHub Advisory Database

github.com

bostr

improper authorization

vulnerability

authorized keys

noscraper

bqouncer

private bouncer

patches

workarounds

references

software

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Even with authorized_keys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it’s pubkey is not in authorized_keys.

Impact

Private bouncer

Patches

Available on version 3.0.10

Workarounds

Disable noscraper if you have authorized_keys being set in config

References

This line of code is the cause.

Affected configurations

Vulners

Node

yonlebostrRange<3.0.10

VendorProductVersionCPE
yonlebostr*cpe:2.3:a:yonle:bostr:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yonle	bostr	*	cpe:2.3:a:yonle:bostr::::::::