vantage6 Node accepts non-whitelisted algorithms from malicious server

CVE-2023-47631

What is CVE-2023-47631?

A vulnerability exists in the Vantage6 framework that allows unauthorized execution of tasks. If a malicious actor compromises a server, they can exploit the lack of validation on the 'parent_id' parameter. This vulnerability enables attackers to run non-whitelisted algorithms since the node neglects to conduct necessary checks when the 'parent_id' is compromised. As a result, every server breached by a skilled attacker is at risk. Users are strongly advised to upgrade to version 4.1.2 to mitigate this risk.

References