2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-24769

CVE-2024-24769: Vantage6: No limit on emails sent for password/MFA reset

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam sender. Note resetting the MFA token requires a correct password, so the potential impact for this is very low. Version 5.0.0 fixes the issue. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-24769

CVE-2024-24769:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vantage6	pip	< 5.0.0	5.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described as 'No limit on emails sent for password/MFA reset' was addressed in vantage6 version 5.0.0. The fix involved a complete migration of the authentication system to Keycloak, as detailed in the release notes. This migration removed the custom-built authentication logic that contained the rate-limiting flaw.

The vulnerable functions were part of the API endpoints that handled password and MFA recovery. By analyzing the code structure of vantage6 before version 5.0.0, the most likely location for this logic is in vantage6-server/vantage6/server/resource/recover.py. The post methods of the PasswordLost and MfaLost resources were responsible for sending recovery emails. Since these methods lacked any rate-limiting mechanism, they could be abused to send an excessive number of emails, leading to the described denial-of-service vulnerability. Therefore, these functions are the primary indicators of the vulnerability being exploited in a runtime environment.

Vulnerable functions

vantage6.server.resource.recover.PasswordLost.post

vantage6-server/vantage6/server/resource/recover.py

This function handles the 'password lost' request. In vulnerable versions, it could be called repeatedly to send a large number of emails to a user, leading to a denial-of-service condition. There was no rate-limiting in place to prevent this abuse.

vantage6.server.resource.recover.MfaLost.post

vantage6-server/vantage6/server/resource/recover.py

This function handles the 'MFA lost' request. Similar to the password reset, it was vulnerable to being called an unlimited number of times, allowing an attacker to flood a user's inbox and potentially disrupt the mail server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.