CVE-2024-29868 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
Attackers can guess weak recovery tokens to take over user accounts in Apache StreamPipes due to insecure random number generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29868?
CVE-2024-29868 is a critical vulnerability in Apache StreamPipes, published on 24 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.
Users are recommended to upgrade to version 0.95.0, which fixes the issue.
Weakness: CWE-338
Which versions are affected by CVE-2024-29868?
2 open source packages ship an affected version, including org.apache.streampipes:streampipes-resource-management. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampipes:streampipes-resource-management Maven | From 0.69.0 | 0.95.0 |
org.apache.streampipes:streampipes-resource-management Maven | From 0.69.0 | 0.95.0 |
Products include Apache Streampipes.
How do I fix CVE-2024-29868?
Upgrade org.apache.streampipes:streampipes-resource-management to 0.95.0 or later.
Is CVE-2024-29868 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29868 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Apache StreamPipes
- CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user
- CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation
- CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process
- CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation
- CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload
Sources
Also known as GHSA-cf3q-vg8w-mw84.