CVE-2024-56329 Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream

What is CVE-2024-56329?

CVE-2024-56329 is a high-severity authentication bypass vulnerability in joelbutcher socialstream, published on 20 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if ->stateless() is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure that users explicitly confirm account linking and avoid configurations that skip critical security checks. Socialstream v6.2 introduces a new custom route that requires a user to "Confirm" or "Deny" a request to link a social account. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-287

Which versions are affected by CVE-2024-56329?

4 open source packages ship an affected version, including joelbutcher/socialstream.

How do I fix CVE-2024-56329?

Upgrade joelbutcher/socialstream to a fixed version for your release line: 5.6.0 or 6.2.0.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-56329 being exploited?

There is no known exploitation of CVE-2024-56329 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3q97-vjpp-c8rp.