CVE-2024-21495 Use of Insufficiently Random Values in github.com/greenpau/caddy-security
Insecure randomness in Caddy security plugin allows attackers to predict nonces and secrets, enabling OAuth replay attacks and MFA bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21495?
CVE-2024-21495 is a medium-severity vulnerability in github.com/greenpau/caddy-security, published on 17 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.
Weakness: CWE-330
Which versions are affected by CVE-2024-21495?
3 open source packages ship an affected version, including github.com/greenpau/caddy-security. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/greenpau/caddy-security Go | All versions | None |
github.com/greenpau/caddy-security Go | All versions to 1.0.42 | None |
github.com/greenpau/caddy-security Go | All versions to 1.0.42 | None |
Products include Greenpau Caddy-Security.
How do I fix CVE-2024-21495?
No fix has been published for CVE-2024-21495 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-21495 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21495 exists.
Other vulnerabilities in github.com/greenpau/caddy-security
- CVE-2024-21494 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
- CVE-2024-21497 Open Redirect in github.com/greenpau/caddy-security
- CVE-2024-21493 Improper Validation of Array Index in github.com/greenpau/caddy-security
- CVE-2024-21499 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security
Sources
Also known as GHSA-c7vf-m394-m4x4, GO-2024-2565.