CVE-2024-10295 Auth bypass in Red Hat 3scale API Management Platform 2
Attackers can bypass authentication in Red Hat 3scale API Management Gateway by sending malformed basic auth headers, gaining unauthorized access to backend services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10295?
CVE-2024-10295 is a high-severity authentication bypass vulnerability in Red Hat 3scale API Management Platform 2, published on 24 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.
Weakness: CWE-863
Which versions are affected by CVE-2024-10295?
It affects 1 product.
Products include Redhat 3scale Api Management.
How do I fix CVE-2024-10295?
No fix has been published for CVE-2024-10295 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-10295 being exploited?
There is no known exploitation of CVE-2024-10295 in the wild and no public exploit code.
Other vulnerabilities in Red Hat 3scale API Management Platform 2
- CVE-2022-1414 Cross-site scripting in 3scale-amp-system
- CVE-2019-14852 A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol.
- CVE-2021-20252 Denial of service in 3scale/backend
- CVE-2020-14388 Missing authorization in Red Hat 3scale API Management
- CVE-2023-4910 3scale-admin-portal: logged out users tokens can be accessed
Sources
Also known as GHSA-qh7g-57ww-6fq4.