GHSA-xwx7-p63r-2rj8

Source

https://github.com/advisories/GHSA-xwx7-p63r-2rj8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-xwx7-p63r-2rj8/GHSA-xwx7-p63r-2rj8.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xwx7-p63r-2rj8

Aliases

CVE-2024-56362

Published

2024-12-23T20:17:44Z

Modified

2024-12-23T20:27:14.290590Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Navidrome Stores JWT Secret in Plaintext in navidrome.db

Details

Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could: - Forge valid tokens to impersonate users, including administrative accounts. - Gain unauthorized access to sensitive data or perform privileged actions. This vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.

Database specific

{
    "nvd_published_at": "2024-12-23T18:15:07Z",
    "cwe_ids": [
        "CWE-312"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-23T20:17:44Z"
}

References

Affected packages

Go / github.com/navidrome/navidrome

Package

Name: github.com/navidrome/navidrome; View open source insights on deps.dev
Purl: pkg:golang/github.com/navidrome/navidrome

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.54.1

Database specific

{
    "last_known_affected_version_range": "<= 0.53.3"
}