Falta de Autenticação para Função Crítica no backend do Webhood

The impact of CVE-2024-31218 is severe. Successful exploitation allows an attacker to gain full administrative access to the Webhood instance and its associated Pocketbase database. This includes the ability to modify, delete, and exfiltrate data scanned by Webhood, as well as potentially compromise the underlying infrastructure. Given Webhood's purpose of analyzing potentially malicious URLs, an attacker could leverage this access to inject malicious URLs into the system, effectively turning it into a phishing distribution platform. The lack of authentication makes this vulnerability particularly concerning, as no prior interaction with the system is required for exploitation.

Organizations utilizing Webhood for URL scanning, particularly those deploying it in self-hosted environments, are at significant risk. Shared hosting environments where Webhood is installed alongside other applications are especially vulnerable, as an attacker could potentially compromise the entire hosting account.

• docker: Inspect running containers for Webhood versions prior to 0.9.1. Use docker ps to identify containers and docker exec -it <container_id> sh to access the container's shell. Then, check the version using webhood --version. • generic web: Monitor access logs for requests to /api/admin/users without authentication headers. Look for POST requests to this endpoint originating from unusual IP addresses. • generic web: Monitor Pocketbase database logs for new admin user creation events. These logs typically contain timestamps and user details.

1. 2024-04-05Disclosure

   disclosure

1. Reservado2024-03-29
2. Publicada2024-04-05
3. Modificada2024-09-06
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-31218 is to immediately upgrade Webhood to version 0.9.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /api/admin/users endpoint, specifically those originating from unauthenticated sources. Monitor Pocketbase database logs for suspicious activity, particularly account creation attempts. Review Webhood's deployment configuration to ensure that no default admin accounts are present and that appropriate security measures are in place. After upgrading, confirm the fix by attempting to access the Pocketbase admin API without authentication; access should be denied.