Privilege Escalation Vulnerability in Conduit Client-Server API

CVE-2024-6303

What is CVE-2024-6303?

A vulnerability exists in the Client-Server API of the Conduit application, allowing unauthorized actions due to missing authorization checks. This issue enables any user to manipulate aliases by adding or removing the #admins alias to different rooms. As a result, an attacker could gain control over a room they do not own, leading to potential privilege escalation. Such unauthorized access could be exploited to execute commands for resetting passwords, signing JSON data with the server's key, deactivating user accounts, and more. Users of Conduit versions prior to 0.8.0 are advised to take immediate action to secure their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References