Vulnerability-Lookup

CVE-2024-21491 (GCVE-0-2024-21491)

Vulnerability from cvelistv5 – Published: 2024-02-13 05:00 – Updated: 2025-05-09 18:25

Summary

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

CWE

CWE-288 - Authentication Bypass

Assigner

snyk

References

URL

Tags

	https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729
	https://github.com/svix/svix-webhooks/pull/1190
	https://github.com/svix/svix-webhooks/commit/9588…
	https://rustsec.org/advisories/RUSTSEC-2024-0010.html

Impacted products

	Vendor	Product	Version
	n/a	svix	Affected: 0 , < 1.17.0 (semver)

Credits

Fredrik Meringdal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:20:40.878Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/svix/svix-webhooks/pull/1190"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-21T20:12:36.693619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T18:25:35.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "svix",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "1.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Fredrik Meringdal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-06T14:09:36.126Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
        },
        {
          "url": "https://github.com/svix/svix-webhooks/pull/1190"
        },
        {
          "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
        },
        {
          "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2024-21491",
    "datePublished": "2024-02-13T05:00:02.196Z",
    "dateReserved": "2023-12-22T12:33:20.118Z",
    "dateUpdated": "2025-05-09T18:25:35.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:svix:svix-webhooks:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.17.0\", \"matchCriteriaId\": \"1748F9E0-E919-496F-BD6E-8A0787D334D7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\\r\\r**Note:**\\r\\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.\"}, {\"lang\": \"es\", \"value\": \"Las versiones del paquete svix anteriores a la 1.17.0 son vulnerables a la omisi\\u00f3n de autenticaci\\u00f3n debido a un problema en la funci\\u00f3n de verificaci\\u00f3n donde las firmas de diferentes longitudes se comparan incorrectamente. Un atacante puede eludir la verificaci\\u00f3n de firma proporcionando una firma m\\u00e1s corta que coincida con el comienzo de la firma real. **Nota:** El atacante necesitar\\u00eda saber que la v\\u00edctima usa la librer\\u00eda Rust para la verificaci\\u00f3n, no hay una manera f\\u00e1cil de verificarlo autom\\u00e1ticamente; y utiliza webhooks de un servicio que utiliza Svix, y luego encuentra una manera de crear una carga \\u00fatil maliciosa que en realidad incluir\\u00e1 todos los identificadores correctos necesarios para enga\\u00f1ar a los receptores y causar problemas reales.\"}]",
      "id": "CVE-2024-21491",
      "lastModified": "2025-01-03T19:40:54.883",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"report@snyk.io\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 4.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-02-13T05:15:08.873",
      "references": "[{\"url\": \"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\", \"source\": \"report@snyk.io\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/svix/svix-webhooks/pull/1190\", \"source\": \"report@snyk.io\", \"tags\": [\"Patch\"]}, {\"url\": \"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\", \"source\": \"report@snyk.io\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\", \"source\": \"report@snyk.io\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/svix/svix-webhooks/pull/1190\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "report@snyk.io",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"report@snyk.io\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-288\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-347\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-21491\",\"sourceIdentifier\":\"report@snyk.io\",\"published\":\"2024-02-13T05:15:08.873\",\"lastModified\":\"2025-05-09T19:15:59.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\\r\\r**Note:**\\r\\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.\"},{\"lang\":\"es\",\"value\":\"Las versiones del paquete svix anteriores a la 1.17.0 son vulnerables a la omisi\u00f3n de autenticaci\u00f3n debido a un problema en la funci\u00f3n de verificaci\u00f3n donde las firmas de diferentes longitudes se comparan incorrectamente. Un atacante puede eludir la verificaci\u00f3n de firma proporcionando una firma m\u00e1s corta que coincida con el comienzo de la firma real. **Nota:** El atacante necesitar\u00eda saber que la v\u00edctima usa la librer\u00eda Rust para la verificaci\u00f3n, no hay una manera f\u00e1cil de verificarlo autom\u00e1ticamente; y utiliza webhooks de un servicio que utiliza Svix, y luego encuentra una manera de crear una carga \u00fatil maliciosa que en realidad incluir\u00e1 todos los identificadores correctos necesarios para enga\u00f1ar a los receptores y causar problemas reales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"report@snyk.io\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"report@snyk.io\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-288\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-288\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:svix:svix-webhooks:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.17.0\",\"matchCriteriaId\":\"1748F9E0-E919-496F-BD6E-8A0787D334D7\"}]}]}],\"references\":[{\"url\":\"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\",\"source\":\"report@snyk.io\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/svix/svix-webhooks/pull/1190\",\"source\":\"report@snyk.io\",\"tags\":[\"Patch\"]},{\"url\":\"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\",\"source\":\"report@snyk.io\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\",\"source\":\"report@snyk.io\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/svix/svix-webhooks/pull/1190\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/svix/svix-webhooks/pull/1190\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T22:20:40.878Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-21491\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-21T20:12:36.693619Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-288\", \"description\": \"CWE-288 Authentication Bypass Using an Alternate Path or Channel\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-09T18:25:30.919Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Fredrik Meringdal\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"n/a\", \"product\": \"svix\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.17.0\", \"versionType\": \"semver\"}]}], \"references\": [{\"url\": \"https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729\"}, {\"url\": \"https://github.com/svix/svix-webhooks/pull/1190\"}, {\"url\": \"https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6\"}, {\"url\": \"https://rustsec.org/advisories/RUSTSEC-2024-0010.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\\r\\r**Note:**\\r\\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-288\", \"description\": \"Authentication Bypass\"}]}], \"providerMetadata\": {\"orgId\": \"bae035ff-b466-4ff4-94d0-fc9efd9e1730\", \"shortName\": \"snyk\", \"dateUpdated\": \"2024-03-06T14:09:36.126Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-21491\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-09T18:25:35.884Z\", \"dateReserved\": \"2023-12-22T12:33:20.118Z\", \"assignerOrgId\": \"bae035ff-b466-4ff4-94d0-fc9efd9e1730\", \"datePublished\": \"2024-02-13T05:00:02.196Z\", \"assignerShortName\": \"snyk\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

cve-2024-21491

Vulnerability from osv_rustsec

Published

2024-02-06 12:00

Modified

2024-02-15 01:22

Summary

Improper comparison of different-length signatures

Details

The Webhook::verify function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in v1, as the signature, which would always pass verification.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "svix::webhooks::Webhook::verify"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "svix",
        "purl": "pkg:cargo/svix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.17.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2024-21491",
    "GHSA-747x-5m58-mq97",
    "GHSA-w277-wpqf-rcfv"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `Webhook::verify` function incorrectly compared signatures of\ndifferent lengths - the two signatures would only be compared up to\nthe length of the shorter signature. This allowed an attacker to\npass in `v1,` as the signature, which would always pass verification.",
  "id": "RUSTSEC-2024-0010",
  "modified": "2024-02-15T01:22:49Z",
  "published": "2024-02-06T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/svix"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Improper comparison of different-length signatures"
}

GSD-2024-21491

Vulnerability from gsd - Updated: 2023-12-23 06:02

Details

Aliases

CVE-2024-21491

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-21491"
      ],
      "details": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.",
      "id": "GSD-2024-21491",
      "modified": "2023-12-23T06:02:09.388697Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "report@snyk.io",
        "ID": "CVE-2024-21491",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "svix",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "1.17.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Fredrik Meringdal"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-288",
                "lang": "eng",
                "value": "Authentication Bypass"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729",
            "refsource": "MISC",
            "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
          },
          {
            "name": "https://github.com/svix/svix-webhooks/pull/1190",
            "refsource": "MISC",
            "url": "https://github.com/svix/svix-webhooks/pull/1190"
          },
          {
            "name": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6",
            "refsource": "MISC",
            "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
          },
          {
            "name": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html",
            "refsource": "MISC",
            "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues."
          },
          {
            "lang": "es",
            "value": "Las versiones del paquete svix anteriores a la 1.17.0 son vulnerables a la omisi\u00f3n de autenticaci\u00f3n debido a un problema en la funci\u00f3n de verificaci\u00f3n donde las firmas de diferentes longitudes se comparan incorrectamente. Un atacante puede eludir la verificaci\u00f3n de firma proporcionando una firma m\u00e1s corta que coincida con el comienzo de la firma real. **Nota:** El atacante necesitar\u00eda saber que la v\u00edctima usa la librer\u00eda Rust para la verificaci\u00f3n, no hay una manera f\u00e1cil de verificarlo autom\u00e1ticamente; y utiliza webhooks de un servicio que utiliza Svix, y luego encuentra una manera de crear una carga \u00fatil maliciosa que en realidad incluir\u00e1 todos los identificadores correctos necesarios para enga\u00f1ar a los receptores y causar problemas reales."
          }
        ],
        "id": "CVE-2024-21491",
        "lastModified": "2024-03-06T14:15:48.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.2,
              "source": "report@snyk.io",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-13T05:15:08.873",
        "references": [
          {
            "source": "report@snyk.io",
            "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
          },
          {
            "source": "report@snyk.io",
            "url": "https://github.com/svix/svix-webhooks/pull/1190"
          },
          {
            "source": "report@snyk.io",
            "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
          },
          {
            "source": "report@snyk.io",
            "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
          }
        ],
        "sourceIdentifier": "report@snyk.io",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-288"
              }
            ],
            "source": "report@snyk.io",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2024-21491

Vulnerability from fkie_nvd - Published: 2024-02-13 05:15 - Updated: 2025-05-09 19:15

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
report@snyk.io	https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6	Patch
report@snyk.io	https://github.com/svix/svix-webhooks/pull/1190	Patch
report@snyk.io	https://rustsec.org/advisories/RUSTSEC-2024-0010.html	Third Party Advisory
report@snyk.io	https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/svix/svix-webhooks/pull/1190	Patch
af854a3a-2127-422b-91ae-364da2661108	https://rustsec.org/advisories/RUSTSEC-2024-0010.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729	Third Party Advisory

Impacted products

	Vendor	Product	Version
	svix	svix-webhooks	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:svix:svix-webhooks:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1748F9E0-E919-496F-BD6E-8A0787D334D7",
              "versionEndExcluding": "1.17.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues."
    },
    {
      "lang": "es",
      "value": "Las versiones del paquete svix anteriores a la 1.17.0 son vulnerables a la omisi\u00f3n de autenticaci\u00f3n debido a un problema en la funci\u00f3n de verificaci\u00f3n donde las firmas de diferentes longitudes se comparan incorrectamente. Un atacante puede eludir la verificaci\u00f3n de firma proporcionando una firma m\u00e1s corta que coincida con el comienzo de la firma real. **Nota:** El atacante necesitar\u00eda saber que la v\u00edctima usa la librer\u00eda Rust para la verificaci\u00f3n, no hay una manera f\u00e1cil de verificarlo autom\u00e1ticamente; y utiliza webhooks de un servicio que utiliza Svix, y luego encuentra una manera de crear una carga \u00fatil maliciosa que en realidad incluir\u00e1 todos los identificadores correctos necesarios para enga\u00f1ar a los receptores y causar problemas reales."
    }
  ],
  "id": "CVE-2024-21491",
  "lastModified": "2025-05-09T19:15:59.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "report@snyk.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-02-13T05:15:08.873",
  "references": [
    {
      "source": "report@snyk.io",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
    },
    {
      "source": "report@snyk.io",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    },
    {
      "source": "report@snyk.io",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "source": "report@snyk.io",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
    }
  ],
  "sourceIdentifier": "report@snyk.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "report@snyk.io",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-747X-5M58-MQ97

Vulnerability from github – Published: 2024-02-13 06:30 – Updated: 2024-10-16 17:06

Summary

svix vulnerable to Authentication Bypass

Details

Note:

The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "svix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21491"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-13T18:36:52Z",
    "nvd_published_at": "2024-02-13T05:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\n\n**Note:**\n\nThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.",
  "id": "GHSA-747x-5m58-mq97",
  "modified": "2024-10-16T17:06:15Z",
  "published": "2024-02-13T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21491"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/svix/svix-webhooks"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "svix vulnerable to Authentication Bypass"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-21491 (GCVE-0-2024-21491)

cve-2024-21491

Vulnerability from osv_rustsec

GSD-2024-21491

FKIE_CVE-2024-21491

GHSA-747X-5M58-MQ97

Tags

Sightings

Nomenclature