CVE-2024-56799 Simofa Allows Unauthenticated Access to API Routes
Attackers can access protected API routes without authentication due to a design flaw in Simofa, potentially exposing or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-56799?
CVE-2024-56799 is a critical missing authorization vulnerability in TrueWinter simofa, published on 30 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication. This vulnerability has been patched in v0.2.7.
Weakness: CWE-306
Which versions are affected by CVE-2024-56799?
How do I fix CVE-2024-56799?
No fix has been published for CVE-2024-56799 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-56799 being exploited?
There is no known exploitation of CVE-2024-56799 in the wild and no public exploit code.
Sources
Also known as GHSA-83qw-5qq5-v7pq.