CVE-2023-50974 Apprite CLI makes Use of Hard-coded Credentials
Local attackers can read Appwrite user credentials from the CLI configuration file due to insecure file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50974?
CVE-2023-50974 is a medium-severity vulnerability in n/a, published on 9 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
Weakness: CWE-798
Which versions are affected by CVE-2023-50974?
5 open source packages ship an affected version, including appwrite and appwrite-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
appwrite PyPI | All versions | 3.0.0 |
appwrite PyPI | All versions | 3.0.0 |
appwrite PyPI | All versions | 3.0.0 |
appwrite-cli npm | All versions | 3.0.0 |
appwrite-cli npm | All versions | 3.0.0 |
Products include Appwrite Command Line Interface.
How do I fix CVE-2023-50974?
Upgrade appwrite to 3.0.0 or later.
Is CVE-2023-50974 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50974 exists.
Sources
Also known as GHSA-g777-crp9-m27g, PYSEC-2024-2.