Lucene search

GitHub_MCVE-2024-41962

HistoryAug 01, 2024 - 5:16 p.m.

CVE-2024-41962

2024-08-0117:16:09

CWE-285

GitHub_M

web.nvd.nist.gov

bostr

proxy

unauthorized access

vulnerability

nostr relay

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.

Affected configurations

Nvd

Vulners

Node

yonlebostrRange<3.0.10

VendorProductVersionCPE
yonlebostr*cpe:2.3:a:yonle:bostr:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yonle	bostr	*	cpe:2.3:a:yonle:bostr::::::::

CNA Affected

[
  {
    "vendor": "Yonle",
    "product": "bostr",
    "versions": [
      {
        "version": "< 3.0.10",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21

github.com/Yonle/bostr/commit/49181f4ec9ae1472c6675cab56bbc01e723855af

github.com/Yonle/bostr/releases/tag/3.0.10

github.com/Yonle/bostr/security/advisories/GHSA-5cf7-cxrf-mq73