ZIPLINE · CVE-2024-58405 · Package
NO FIX YET · SEE WHAT TO DO
Zipline through 3.7.9 enforces invite codes on /api/auth/register only when user registration is disabled, so with invites and registration both enabled, a POST request without an invite code still creates an account. An unauthenticated attacker can use this to create accounts, view stats, and fill storage by uploading many files.
first public Mar 5, 2024 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Zipline 3.7.9 or earlier with invite codes and user registration both enabled are exposed, because the registration endpoint skips the invite check in that configuration. Instances with registration disabled, or without invites enabled, are not described as affected by the sources.
Not affected if invites-disabled, registration-disabled
Who cares self-hosted, zipline
3.7.9: check env/config for FEATURES_USER_REGISTRATION=true together with FEATURES_INVITES=trueBad invite means notZipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.