CVE-2024-25633

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. This vulnerability has been fixed since version 5.0.0, released on February 17th 2024. Some workarounds are available. Disabling both options that allow *administrators* to create users will provide a mitigation. Additionally, disabling anonymous user access will stop anonymous access (including using existing access keys).

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v

Configurations

No configuration.

History

No history.

Information

Published : 2024-08-15 19:15

Updated : 2024-08-19 14:15

NVD link : CVE-2024-25633

Mitre link : CVE-2024-25633

CVE.ORG link : CVE-2024-25633

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2024-25633", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-08-15T19:15:18.213", "references": [{"url": "https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled (disabled by default) an unauthenticated user can create regular users in any team. This vulnerability has been fixed since version 5.0.0, released on February 17th 2024. Some workarounds are available. Disabling both options that allow *administrators* to create users will provide a mitigation. Additionally, disabling anonymous user access will stop anonymous access (including using existing access keys)."}, {"lang": "es", "value": "eLabFTW es un cuaderno de laboratorio electr\u00f3nico de c\u00f3digo abierto para laboratorios de investigaci\u00f3n. En un sistema eLabFTW, se podr\u00eda no permitir la creaci\u00f3n de usuarios excepto por parte de administradores del sistema, administradores y servicios confiables. Si a los administradores se les permite crear nuevos usuarios (que es la opci\u00f3n predeterminada), la vulnerabilidad permite a cualquier usuario crear nuevos usuarios en equipos de los que son miembros. Los nuevos usuarios se validan autom\u00e1ticamente y no se notifica a los administradores. Esto puede permitir que un usuario con acceso permanente o temporal a una cuenta de usuario o clave API mantenga la persistencia en un sistema eLabFTW. Adem\u00e1s, permite al usuario crear una cuenta separada con un nombre diferente y generar historiales de revisiones enga\u00f1osos. No se otorgan privilegios adicionales al nuevo usuario. Los usuarios deben actualizar a la versi\u00f3n 5.0.0 para recibir un parche. Como soluci\u00f3n alternativa, deshabilitar ambas opciones que permiten a los *administradores* crear usuarios proporcionar\u00e1 una mitigaci\u00f3n."}], "lastModified": "2024-08-19T14:15:21.880", "sourceIdentifier": "security-advisories@github.com"}