CWE-312

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.53.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/navidrome/navidrome"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.54.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-56362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-23T20:17:44Z",
    "nvd_published_at": "2024-12-23T18:15:07Z",
    "severity": "HIGH"
  },
  "details": "Navidrome stores the JWT secret in plaintext in the `navidrome.db` database file under the `property` table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret.\nThe JWT secret is critical for the authentication and authorization system. If exposed, an attacker could:\n- Forge valid tokens to impersonate users, including administrative accounts.\n- Gain unauthorized access to sensitive data or perform privileged actions.\nThis vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.\n\n![image](https://github.com/user-attachments/assets/29aae867-f21f-4d70-bda0-d2bb87d754d9)\n",
  "id": "GHSA-xwx7-p63r-2rj8",
  "modified": "2025-01-15T20:47:44Z",
  "published": "2024-12-23T20:17:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-xwx7-p63r-2rj8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56362"
    },
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/commit/7f030b0859653593fd2ac0df69f4a313f9caf9ff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/commit/9cbdb20a318a49daf95888b1fd207d4d729b55f1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/navidrome/navidrome"
    },
    {
      "type": "WEB",
      "url": "https://github.com/navidrome/navidrome/releases/tag/v0.54.1"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-3357"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Navidrome Stores JWT Secret in Plaintext in navidrome.db"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-24660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-20T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.",
  "id": "GHSA-xxw8-ppw6-gv4w",
  "modified": "2022-07-28T00:00:40Z",
  "published": "2022-07-21T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24660"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goldshellminer/firmware"
    },
    {
      "type": "WEB",
      "url": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}