CVE-2024-41962 Bostr Improper Authorization
Attackers can bypass authorization checks in Bostr when noscraper is enabled, allowing unauthorized access to the relay service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-41962?
CVE-2024-41962 is a medium-severity missing authorization vulnerability in Yonle bostr, published on 1 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.
Weakness: CWE-285
Which versions are affected by CVE-2024-41962?
2 open source packages ship an affected version, including bostr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bostr npm | All versions | 3.0.10 |
bostr npm | All versions | 3.0.10 |
Products include Yonle Bostr.
How do I fix CVE-2024-41962?
Upgrade bostr to 3.0.10 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-41962 being exploited?
There is no known exploitation of CVE-2024-41962 in the wild and no public exploit code.
Sources
Also known as GHSA-5cf7-cxrf-mq73.