GitHub Advisoryadvisory · npm

GHSA-5cf7-cxrf-mq73 Bostr Improper Authorization vulnerability

MEDIUM Published 2024-08-02 Modified 2024-08-02 Official page ↗
Aliases
CVE-2024-41962
Ecosystem
npm
Packages
bostr
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weaknesses
CWE-285
Reviewed
2024-08-02

Affected packages

• npm bostr: < 3.0.10 → fixed in 3.0.10

Description

Even with `authorized_keys` is filled with allowed pubkeys, If `noscraper` is enabled, It will allow anyone to use bouncer even it's pubkey is not in `authorized_keys`. Impact • Private bouncer Patches Available on version 3.0.10 Workarounds Disable `noscraper` if you have `authorized_keys` being set in config References This line of code is the cause.

Related

Alias · CVE (1)

  • CVE-2024-41962 Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References