Vulnerability-Lookup

GHSA-747X-5M58-MQ97

Vulnerability from github – Published: 2024-02-13 06:30 – Updated: 2024-10-16 17:06

Summary

svix vulnerable to Authentication Bypass

Details

Note:

The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "svix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21491"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-13T18:36:52Z",
    "nvd_published_at": "2024-02-13T05:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\n\n**Note:**\n\nThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.",
  "id": "GHSA-747x-5m58-mq97",
  "modified": "2024-10-16T17:06:15Z",
  "published": "2024-02-13T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21491"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/svix/svix-webhooks"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "svix vulnerable to Authentication Bypass"
}

ghsa-747x-5m58-mq97

Vulnerability from osv_rustsec

Published

2024-02-06 12:00

Modified

2024-02-15 01:22

Summary

Improper comparison of different-length signatures

Details

The Webhook::verify function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in v1, as the signature, which would always pass verification.

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "crypto-failure"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "svix::webhooks::Webhook::verify"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "svix",
        "purl": "pkg:cargo/svix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "1.17.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2024-21491",
    "GHSA-747x-5m58-mq97",
    "GHSA-w277-wpqf-rcfv"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `Webhook::verify` function incorrectly compared signatures of\ndifferent lengths - the two signatures would only be compared up to\nthe length of the shorter signature. This allowed an attacker to\npass in `v1,` as the signature, which would always pass verification.",
  "id": "RUSTSEC-2024-0010",
  "modified": "2024-02-15T01:22:49Z",
  "published": "2024-02-06T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/svix"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svix/svix-webhooks/pull/1190"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Improper comparison of different-length signatures"
}

CVE-2024-21491 (GCVE-0-2024-21491)

Vulnerability from cvelistv5 – Published: 2024-02-13 05:00 – Updated: 2025-05-09 18:25

Summary

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature. **Note:** The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

CWE

CWE-288 - Authentication Bypass

Assigner

snyk

References

URL

Tags

	https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729
	https://github.com/svix/svix-webhooks/pull/1190
	https://github.com/svix/svix-webhooks/commit/9588…
	https://rustsec.org/advisories/RUSTSEC-2024-0010.html

Impacted products

	Vendor	Product	Version
	n/a	svix	Affected: 0 , < 1.17.0 (semver)

Credits

Fredrik Meringdal

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:20:40.878Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/svix/svix-webhooks/pull/1190"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-21T20:12:36.693619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T18:25:35.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "svix",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "1.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Fredrik Meringdal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-06T14:09:36.126Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729"
        },
        {
          "url": "https://github.com/svix/svix-webhooks/pull/1190"
        },
        {
          "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
        },
        {
          "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2024-21491",
    "datePublished": "2024-02-13T05:00:02.196Z",
    "dateReserved": "2023-12-22T12:33:20.118Z",
    "dateUpdated": "2025-05-09T18:25:35.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-747X-5M58-MQ97

ghsa-747x-5m58-mq97

Vulnerability from osv_rustsec

CVE-2024-21491 (GCVE-0-2024-21491)

Tags

Sightings

Nomenclature