CVE-2024-24554 - Bludit - Insecure Token Generation

Back Back to CVE browser

MEDIUM

Bludit - Insecure Token Generation

Published Jun 24, 2024

6.0

MEDIUM

CVSS 4.0

EPSS 0.24%

Description

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.

Affected products

Vendor Bludit Product Bludit Default
unaffected
- Version
  2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bludit

unaffected

Version	Status	Constraints
2.0	affected	-

Remediation

Vendor solution

Generating secure API and user auth tokens in PHP involves creating unique and cryptographically secure strings that can be used as tokens for authentication purposes. The following code snippet is a basic example of how to generate secure API tokens in PHP:

```php function generateApiToken($length = 32) { $token = bin2hex(random_bytes($length)); return $token; } ```

Weaknesses (2)

CWE-287

Improper Authentication

CWE-338

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21972
Advisory
https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21972		Advisory
https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/		Third Party Advisory