Lif Auth Server vulnerable to uncontrolled data in path expression
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lif-Platforms | Lif-Auth-Server | 1.3.2 to before 1.4.0 | 1.4.0 | Patch available | CNA |
- Lif-Auth-Server VendorLif-Platforms Affected 1.3.2 to before 1.4.0 Fixed in 1.4.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lifplatforms:lif_auth_server:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | Lif-Platforms |
- cpe:2.3:a:lifplatforms:lif_auth_server:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Lif-Platforms
Remediation
- Fix · CNA Lif-Auth-Server (Lif-Platforms) Fixed in 1.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49801
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences