Vulnerability · Published Sep 7, 2022 · Assigned by GitHub_M

CVE-2022-31149ActivityWatch vulnerable to DNS rebinding attack

High 8.8

In plain English

A high-severity authentication bypass by spoofing in activitywatch from ActivityWatch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.3%top 29.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.

Affected products (as reported)

Vendor	Product	Versions
ActivityWatch	activitywatch	< 0.12.0b2

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-v9fg-6g9j-h4x4 x_refsource_CONFIRM
https://gist.github.com/zozs/fdebbce75fc8538c15851b46db944a16 x_refsource_MISC
https://github.com/ActivityWatch/activitywatch/discussions/778 x_refsource_MISC