Vulnerability · Published Nov 20, 2024 · Assigned by GitHub_M
CVE-2024-52796Password Pusher's rate limiter can be bypassed by forging proxy headers
Medium 5.3
In plain English
A medium-severity resource allocation without limits in PasswordPusher from pglombardo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. In v1.49.0, a fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | pwpush | 1.49.0 | GHSA-ffp2-8p2h-4m5j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pglombardo | PasswordPusher | < 1.49.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j x_refsource_CONFIRM
- https://docs.pwpush.com/docs/proxies/#trusted-proxies x_refsource_MISC
- https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0 x_refsource_MISC