CRITICAL 9.1 Microsoft PoC
CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.
Microsoft Security Update 2024-Nov: InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.
Affected Products
- cbl2 influxdb 2.6.1-22 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-23 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-24 on CBL Mariner 2.0
- cbl2 influxdb 2.6.1-30 on CBL Mariner 2.0
- azl3 influxdb 2.7.5-13 on Azure Linux 3.0
- azl3 influxdb 2.7.5-14 on Azure Linux 3.0
- azl3 influxdb 2.7.5-15 on Azure Linux 3.0
- azl3 influxdb 2.7.5-17 on Azure Linux 3.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30896
- https://nvd.nist.gov/vuln/detail/CVE-2024-30896
This critical severity vulnerability with a CVSS score of 9.1 was published on 2024-11-12 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 5.4% (top 8% of all CVEs by exploitation probability). Affected: cbl2 influxdb 2.6.1-22 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-23 on CBL Mariner 2.0, cbl2 influxdb 2.6.1-24 on CBL Mariner 2.0 and 5 more.
Risk Timeline
CVE Disclosed2024-11-12 · 691 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
Remediation Resources
Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30896NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2024-30896Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2022-49043 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | CRITICAL | 10.0 |
| CVE-2024-41110 PoC | Moby authz zero length regression | CRITICAL | 9.9 |
| CVE-2025-62878 | Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern | CRITICAL | 9.9 |
| CVE-2023-24531 | Output of "go env" does not sanitize values in cmd/go | CRITICAL | 9.8 |
| CVE-2025-1744 | Out-of-bounds Write in radare2 | CRITICAL | 9.8 |
| CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | CRITICAL | 9.8 |
vulnfeed aggregates 7640 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.