CVE-2024-52796

Summary

CVE-2024-52796 is a vulnerability affecting the open-source application Password Pusher. Prior to version 1.49.0, the application's rate limiter could be bypassed by manipulating proxy headers, allowing for unlimited traffic and potential denial of service attacks. This issue has been resolved in version 1.49.0, which now only authorizes local IP addresses for proxies. A workaround involves configuring proxy and firewall rules to reject external proxy headers such as `X-Forwarded-*`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.