CVE-2024-24756

Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential. This vulnerability is patched in 2.1.5.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67	Product
https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373	Patch
https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:crafatar:crafatar:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-01 23:15

Updated : 2024-02-09 19:47

NVD link : CVE-2024-24756

Mitre link : CVE-2024-24756

CVE.ORG link : CVE-2024-24756

JSON object : View

Products Affected

crafatar

crafatar

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-24756", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-02-01T23:15:11.210", "references": [{"url": "https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential. This vulnerability is patched in 2.1.5."}, {"lang": "es", "value": "Crafatar ofrece avatares de Minecraft basados en la apariencia para su uso en aplicaciones externas. Los archivos fuera del directorio `lib/public/` se pueden solicitar desde el servidor. Las instancias que se ejecutan detr\u00e1s de Cloudflare (incluido crafatar.com) no se ven afectadas. Las instancias que utilizan el contenedor Docker como se muestra en el archivo README se ven afectadas, pero solo se pueden leer los archivos dentro del contenedor. De forma predeterminada, todos los archivos del contenedor tambi\u00e9n se pueden encontrar en este repositorio y no son confidenciales. Esta vulnerabilidad est\u00e1 parcheada en 2.1.5."}], "lastModified": "2024-02-09T19:47:10.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:crafatar:crafatar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBFA1552-D4BE-4660-8B70-260EA05E6D56", "versionEndExcluding": "2.1.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}