CVE-2024-46257

[TheTrueColonel]

Just to bring more visibility to this major bug that was reported. Link includes multiple references on where exactly the issue is and how to reproduce the issue.

https://www.tenable.com/cve/CVE-2024-46257

[tanpro260196]

The maintainer basically never actually check github issue. Please email it directly to him at jc@jc21.com
Hopefully this resolve faster than last time (which took 4 months).

[vsisl]

Hi everyone,

could someone shed a bit more light on how severe this problem is?

Doest this only concern instances of NPM which are exposed to internet or virtually all installations, including the ones behind firewalls?

[TheTrueColonel]

From the information seen on the CVE, it looks like if someone is able to request a Let's Encrypt cert, they are able to exploit this bug. I'm unsure if there's anything external that calls those endpoints an unauthenticated user can exploit, but I have emailed jc and got confirmation that he'll look into the issue as soon as he can.

[barttran2k]

Hello, I am the person who submitted the above CVE, you can refer to my article here: https://viblo.asia/p/phat-hien-rce-nhung-ban-phai-dang-nhap-truoc-da-cau-chuyen-cve-cua-minh-voi-56000-host-MkNLrQaOJgA

[TheTrueColonel]

Looks to have been fixed in #4073

[barttran2k]

Thank you! I was checked and the bug is fixed!