CVE-2024-28192 NoSQL Injection Leading to Authentication Bypass in your_spotify
Attackers can bypass public token authentication in your_spotify via NoSQL injection, gaining unauthorized access without user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28192?
CVE-2024-28192 is a medium-severity authentication bypass vulnerability in Yooooomi your_spotify, published on 13 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token processing logic. Attackers can fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This vulnerability allows an attacker to fully bypass the public token authentication mechanism, regardless if a public token has been generated before or not, without any user interaction or prerequisite knowledge. This issue has been addressed in version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-28192?
It affects 1 product.
Products include Yooooomi Your Spotify.
How do I fix CVE-2024-28192?
No fix has been published for CVE-2024-28192 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-28192 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28192 exists.
Other vulnerabilities in Yooooomi your_spotify
- CVE-2024-28194 Authentication Bypass Because of Hardcoded JWT Secret in your_spotify
- CVE-2024-28195 Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify
- CVE-2024-28193 Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your_spotify
- CVE-2024-28196 Clickjacking in your_spotify
Sources
Also known as GHSA-c8wf-wcjc-2pvm.