CVE-2024-58405: Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated account creation?
Deployments with both invite codes and user registration enabled are exposed. In that configuration, an unauthenticated attacker can submit a direct POST request to /api/auth/register without an invite code.
What can an attacker do after bypassing the invite requirement?
An attacker can create accounts, view stats, and upload many files. The uploads can be used to exhaust available storage.
What network access or credentials does exploitation require?
Exploitation is network-accessible and requires no credentials or user interaction. The attacker only needs to send a direct request to the registration endpoint.