CVE-2024-46508 - Vulnerability Analysis

Overview

yeti-platform yeti before 2.1.12 contains a broken authentication vulnerability caused by use of a default secret key for JWT tokens, letting attackers generate valid tokens, exploit requires default secret key unchanged.

Severity & Score

Impact

Attackers can generate valid JWT tokens, allowing unauthorized access to the system.

Mitigation

Update to version 2.1.12 or later and change YETI_AUTH_SECRET_KEY to a secure value.

References

• https://rhinosecuritylabs.com/research/cve-2024-46507-yeti-server-side-template-injection-ssti/
• https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-46507

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner