CVE-2024-10081
published 2024-11-06CVE-2024-10081: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the…
PriorityP193critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
40.06%
98.4th percentile
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ericsson | codechecker | < 6.24.2 | 6.24.2 |
| ericsson | codechecker | <= 6.24.1 | — |
| ericsson | codechecker | >= 0 < 6.24.2 | 6.24.2 |
| follow-redirects_project | follow-redirects | >= 0 < 1.15.6 | 1.15.6 |
Detection & IOCsextracted from sources · hover to see the quote
- →Authentication bypass is triggered when the API URL path ends with 'Authentication', 'Configuration', or 'ServerInfo'. Detect POST requests to any CodeChecker API endpoint matching this pattern (e.g., /v*/Products/Authentication). ↗
- →Identify exposed CodeChecker instances via Shodan using favicon hash -1496590341. ↗
- ·The bypass affects all API endpoints EXCEPT /Authentication itself. Only endpoints whose URL path ends with 'Authentication', 'Configuration', or 'ServerInfo' are exploitable as bypass vectors; other endpoints are accessible once the bypass is achieved. ↗
- ·The vulnerability affects CodeChecker versions through 6.24.1 only. Version 6.24.2 and later are not affected. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-10081: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
osv·2024-11-06
CVE-2024-10081 CVE-2024-10081: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
GHSA
codechecker vulnerable to authentication bypass when using specifically crafted URLs
ghsa·2024-11-06
CVE-2024-10081 [CRITICAL] CWE-288 codechecker vulnerable to authentication bypass when using specifically crafted URLs
codechecker vulnerable to authentication bypass when using specifically crafted URLs
### Summary
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
### Details
All endpoints, apart from the /Authentication is affected by the vulnerability.
The vulnerability allows unauthenticated users to access all API functionality.
You can look for the following pattern in the logs to check if the vulnerabilty was exploited:
Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in `Authentication`, `Configuration` or `ServerInfo` and it was made by an
OSV
codechecker vulnerable to authentication bypass when using specifically crafted URLs
osv·2024-11-06
CVE-2024-10081 [CRITICAL] codechecker vulnerable to authentication bypass when using specifically crafted URLs
codechecker vulnerable to authentication bypass when using specifically crafted URLs
### Summary
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
### Details
All endpoints, apart from the /Authentication is affected by the vulnerability.
The vulnerability allows unauthenticated users to access all API functionality.
You can look for the following pattern in the logs to check if the vulnerabilty was exploited:
Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in `Authentication`, `Configuration` or `ServerInfo` and it was made by an
GHSA
follow-redirects' Proxy-Authorization header kept across hosts
ghsa·2024-03-14
CVE-2024-28849 [MEDIUM] CWE-200 follow-redirects' Proxy-Authorization header kept across hosts
follow-redirects' Proxy-Authorization header kept across hosts
When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.
## Steps To Reproduce & PoC
Test code:
```js
const axios = require('axios');
axios.get('http://127.0.0.1:10081/', {
headers: {
'AuThorization': 'Rear Test',
'ProXy-AuthoriZation': 'Rear Test',
'coOkie': 't=1'
}
})
.then((response) => {
console.log(response);
})
```
When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.
## Impact
This vulnerability may lead to credentials leak.
## Recommendations
Remove proxy-aut
VulnCheck
CodeChecker API URL Authentication Bypass Vulnerability
vulncheck·2024·CVSS 10.0
CVE-2024-10081 [CRITICAL] CodeChecker API URL Authentication Bypass Vulnerability
CodeChecker API URL Authentication Bypass Vulnerability
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.
Affected: CodeChecker CodeChecker
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/st
No detection rules found.
Nuclei
CodeChecker <= 6.24.1 - Authentication Bypass
nuclei·CVSS 10.0
CVE-2024-10081 [CRITICAL] CodeChecker <= 6.24.1 - Authentication Bypass
CodeChecker <= 6.24.1 - Authentication Bypass
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
Template:
id: CVE-2024-10081
info:
name: CodeChecker <= 6.24.1 - Authentication Bypass
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
impact: |
Unauthenticated attackers can bypass au
2024-11-06
Published
Exploited in the wild