CVE-2024-52796: Pwpush Password Pusher Rate Limiter Can Vulnerability

LOW
Advisory Identifier: GHSA-ffp2-8p2h-4m5j
Share
CVSS 5.3
CWE-770
Published
Advisory Summary

CVE-2024-52796 is a LOW (CVSS 5.3) password pusher rate limiter can vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting Pwpush libraries in the RubyGems ecosystem. The issue involves password pusher rate limiter can be bypassed by forging proxy headers. Remediation is available by upgrading affected packages to version 1.49.0.

CVE-2024-52796 at a Glance

CVE Identifier CVE-2024-52796
GHSA Identifier GHSA-ffp2-8p2h-4m5j
Severity LOW
CVSS v3.1 Base Score 5.3
CWE Classification CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product Pwpush
Package Ecosystem RubyGems
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability Low (A:L)

How to Fix CVE-2024-52796

To remediate this vulnerability, upgrade all affected Pwpush dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pwpush fixed: 1.49.0 
Upgrade pwpush to 1.49.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for pwpush

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-52796, inspect your project dependencies for Pwpush:

inspect dependencies for pwpush

Analyze the terminal output to locate any version of Pwpush in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.49.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In Pwpush, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Password Pusher comes with a configurable rate limiter. In versions prior to [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service. Additionally, with the ability to bypass rate limiting, it also allows attackers to more easily execute brute force attacks. ### Patches In [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), a fix was implemented to only authorize proxies on local IPs which resolves this issue. If you are running a remote proxy, please see [this documentation](https://docs.pwpush.com/docs/proxies/#trusted-proxies) on how to authorize the IP address of your remote proxy. ### Workarounds It is highly suggested to upgrade to at least [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0) to mitigate this risk. If for some reason you cannot immediately upgrade, the alternative is that you can add rules to your proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients. ### References The new settings are [configurable to authorize remote proxies](https://docs.pwpush.com/docs/proxies/#trusted-proxies). ### Credits Thank you to [Positive Technologies](https://www.ptsecurity.com/ww-en/) for reporting and working with me to bring this CVE to the community with the associated fix.

CVE-2024-52796 Affected Pwpush Versions

1 component(s)
Fixed Versions:
1.49.0
Product / Package Ecosystem Affected Versions Fixed Version
pwpush
gem/pwpush
RubyGems
< 1.49.0
1.49.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j
NVD — CVE-2024-52796 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52796
Pwpush Security Information SECURITY
https://docs.pwpush.com/docs/proxies/#trusted-proxies
Pwpush Source Repository REPOSITORY
https://github.com/pglombardo/PasswordPusher
Pwpush Release RELEASE
https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0
Pwpush Source Repository REPOSITORY
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pwpush/CVE-2024-52796.yml

Frequently Asked Questions

What is CVE-2024-52796?
CVE-2024-52796 is a security vulnerability in Pwpush involving Password Pusher rate limiter can be bypassed by forging proxy headers under CWE-770: Allocation of Resources Without Limits or Throttling.
Which Pwpush versions are affected?
Affected versions include releases prior to 1.49.0 across affected packages: pwpush.
What version fixes CVE-2024-52796?
Upgrading to 1.49.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pwpush affected?
Yes, pwpush is affected in releases prior to 1.49.0. Upgrade your dependency to 1.49.0 or later.
What is the CVSS score of CVE-2024-52796?
CVE-2024-52796 has a CVSS v3.1 base score of 5.3 (LOW) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
What CWE is associated with CVE-2024-52796?
CVE-2024-52796 is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check RubyGems dependencies for CVE-2024-52796?
Run the dependency tree command: 'inspect dependencies for pwpush'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-ffp2-8p2h-4m5j",
  "modified" : "2024-11-26T18:59:48Z",
  "published" : "2024-11-20T18:24:28Z",
  "aliases" : [ "CVE-2024-52796" ],
  "summary" : "Password Pusher rate limiter can be bypassed by forging proxy headers",
  "details" : "### Impact\n\nPassword Pusher comes with a configurable rate limiter.  In versions prior to [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service.\n\nAdditionally, with the ability to bypass rate limiting, it also allows attackers to more easily execute brute force attacks.\n\n### Patches\n\nIn [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), a fix was implemented to only authorize proxies on local IPs which resolves this issue.\n\nIf you are running a remote proxy, please see [this documentation](https://docs.pwpush.com/docs/proxies/#trusted-proxies) on how to authorize the IP address of your remote proxy.\n\n### Workarounds\n\nIt is highly suggested to upgrade to at least [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0) to mitigate this risk.\n\nIf for some reason you cannot immediately upgrade, the alternative is that you can add rules to your proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.\n\n### References\n\nThe new settings are [configurable to authorize remote proxies](https://docs.pwpush.com/docs/proxies/#trusted-proxies).\n\n### Credits\n\nThank you to [Positive Technologies](https://www.ptsecurity.com/ww-en/) for reporting and working with me to bring this CVE to the community with the associated fix.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "pwpush"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.49.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-52796"
  }, {
    "type" : "WEB",
    "url" : "https://docs.pwpush.com/docs/proxies/#trusted-proxies"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pglombardo/PasswordPusher"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pwpush/CVE-2024-52796.yml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-20T18:24:28Z",
    "nvd_published_at" : "2024-11-20T17:15:20Z"
  }
}