CVE-2024-21491 svix vulnerable to Authentication Bypass

What is CVE-2024-21491?

CVE-2024-21491 is a medium-severity authentication bypass vulnerability in svix, published on 13 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.

Weakness: CWE-347, CWE-288

Which versions are affected by CVE-2024-21491?

5 open source packages ship an affected version, including svix. It affects 1 product.

Products include Svix Svix-Webhooks.

How do I fix CVE-2024-21491?

Upgrade svix to 1.17.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-21491 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21491 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-747x-5m58-mq97, GHSA-w277-wpqf-rcfv, RUSTSEC-2024-0010.