CVE-2024-24825 TokenManager not checking permissions on cached tokens in DIRAC
Attackers can access tokens requested by other users, exposing resources to unintended parties in the DIRAC distributed resource framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24825?
CVE-2024-24825 is a critical missing authorization vulnerability in DIRACGrid DIRAC, published on 8 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2024-24825?
5 open source packages ship an affected version, including dirac and DIRAC. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dirac PyPI | All versions | 8.0.37 |
dirac PyPI | All versions | 8.0.37 |
dirac PyPI | All versions | 8.0.37 |
dirac PyPI | From 8.0.0 | 8.0.37 |
DIRAC PyPI | From 8.0.0 | 8.0.37 |
Products include Diracgrid Dirac.
How do I fix CVE-2024-24825?
Upgrade dirac to 8.0.37 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-24825 being exploited?
There is no known exploitation of CVE-2024-24825 in the wild and no public exploit code.
Other vulnerabilities in DIRACGrid DIRAC
Sources
Also known as GHSA-59qj-jcjv-662j, PYSEC-2024-125.