PRIOn Logo

CVE-2024-36400 Code injection

Significant
Remediate Within one Month

CVE Information

Original CVE data

Published:
Updated:

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.

CWE: CWE-331
CVSS v2-
CVSS v39.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
https://github.com/viz-rs/nano-id/security/advisories/GHSA-9hc7-6w9r-wj94
https://github.com/viz-rs/nano-id/commit/a9022772b2f1ce38929b5b81eccc670ac9d3ab23
Affected Vendors

Viz - (1)

Basic Analysis

Common vulnerability metrics

Vulnerabilty type as detected by PRIOnengine

Code injection

CVSS Scores as calculated by PRIOnengine
CVSS v24.3
AV:N/AC:M/AU:N/C:P/I:N/A:N
CVSS v39.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
MITRE CWE Top 25

-

Exploits

No exploit code is reported to exist.

Active Exploitation

Vulnerability is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. See the KEV Catalog

Social Network Activity

-

Threat Actor Activity

No sightings of the vulnerability within threat reports.

Cybersecurity Frameworks

How the vulnerability maps against various cybersecurity frameworks

T1499.004 - Endpoint Denial of Service (Application or System Exploitation)
T1110 - Brute Force
T1087 - Account Discovery
T1021 - Remote Services

Compliance Impact

How the submited vulnerability affects compliance

PCI DSS v3.2.1-6.5.3 - Insecure Cryptographic Storage

Web Application Security Frameworks

Applicable if the issue likely affects a web application

-