CVE-2024-10081: codechecker vulnerable to authentication bypass when using specifically crafted URLs

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 39.9%, percentile 99: FIRST’s model estimates a 39.9% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes codechecker (PyPI) < 6.24.2, fixed in 6.24.2. Check your lockfile, including transitive dependencies.

What it is

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability. This issue affects CodeChecker: through 6.24.1.

From the GitHub advisory

Summary Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.

Details All endpoints, apart from the /Authentication is affected by the vulnerability.

The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited:

Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user.

Impact This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.

Weakness type: CWE-288, CWE-420.

Product: codechecker (PyPI) · Assigned by: ERIC · Published: 2024-11-06

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-10-21): 39.92% probability of exploitation activity in the next 30 days; percentile 99.

Timeline

• 2024-11-06 — CVE record last updated
• 2024-11-06 — CVE record published by ERIC
• 2024-11-06 — GitHub-reviewed advisory GHSA-f3f8-vx3w-hp5q published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. github.com github.com

Vulnerability records

1. GitHub Advisory GHSA-f3f8-vx3w-hp5q github.com
2. CVE.org record CVE-2024-10081 cve.org
3. NVD entry CVE-2024-10081 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com

Critical PyPI advisories · Today’s Security Digest