Vulnerability · Published Oct 28, 2024 · Assigned by ProgressSoftware

CVE-2024-9825The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token

Medium 5.4

In plain English

A medium-severity incorrect authorization in Chef Habitat Builder from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Chef Habitat builder-api on-prem-builder package with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token. Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package. The fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.

Affected products (as reported)

Vendor	Product	Versions
Progress Software Corporation	Chef Habitat Builder	0 – before habitat/builder-api/10315/20240913162802

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://docs.chef.io/habitat/builder_overview/ product
https://community.progress.com/s/article/Chef-Habitat-Builder-Product-Alert vendor-advisory