Lucene search

GoogleOSV:GHSA-5CF7-CXRF-MQ73

HistoryAug 02, 2024 - 1:20 a.m.

Bostr Improper Authorization vulnerability

2024-08-0201:20:13

Google

osv.dev

bostr

improper authorization

vulnerability

private bouncer

noscraper

workaround

patch

version 3.0.10

code line

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Even with authorized_keys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it’s pubkey is not in authorized_keys.

Impact

Private bouncer

Patches

Available on version 3.0.10

Workarounds

Disable noscraper if you have authorized_keys being set in config

References

This line of code is the cause.