CVE-2024-10081: Critical severity pip/codechecker vulnerability
Summary Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
Details All endpoints, apart from the /Authentication is affected by the vulnerability.
The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited: !image
Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user.
Impact This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.
Other sources
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10081?
CVE-2024-10081 is considered a high-severity vulnerability due to the potential for authentication bypass and unauthorized superuser access.
How do I fix CVE-2024-10081?
To fix CVE-2024-10081, upgrade the codechecker package to version 6.24.2 or later.
What are the affected versions of the codechecker package for CVE-2024-10081?
The affected versions of the codechecker package for CVE-2024-10081 are 6.24.1 and earlier.
What functionalities can be exploited due to CVE-2024-10081?
CVE-2024-10081 allows attackers to exploit superuser access to manipulate API endpoints, which include adding, editing, and removing products.
Is CVE-2024-10081 limited to specific API endpoints?
Yes, CVE-2024-10081 mainly affects API endpoints that do not include Authentication, allowing access to Configuration and ServerInfo endpoints without proper authentication.