CVE-2024-9825: The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token
The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.
The fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9825?
CVE-2024-9825 is classified as a medium severity vulnerability.
How do I fix CVE-2024-9825?
To mitigate CVE-2024-9825, upgrade the Chef Habitat builder-api to version habitat/builder-api/10315/20240913162802 or higher.
Who is affected by CVE-2024-9825?
CVE-2024-9825 affects users of the Chef Habitat Builder API on versions lower than habitat/builder-api/10315/20240913162802.
What type of vulnerability is CVE-2024-9825?
CVE-2024-9825 is an indirect object reference (IDOR) vulnerability.
What can attackers do with CVE-2024-9825?
Attackers can exploit CVE-2024-9825 to delete personal tokens of unauthorized users.