CVE-2024-38353 CodiMD - Missing Image Access Controls and Unauthorized Image Access
Unauthenticated attackers can access uploaded images in CodiMD due to missing access controls and predictable filenames, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-38353?
CVE-2024-38353 is a medium-severity missing authorization vulnerability in hackmdio codimd, published on 10 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4.
Which versions are affected by CVE-2024-38353?
It affects 1 product.
Products include Hackmd Codimd.
How do I fix CVE-2024-38353?
No fix has been published for CVE-2024-38353 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-38353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38353 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in hackmdio codimd
Sources
Also known as GHSA-2764-jppc-p2hm.