Privilege Escalation Vulnerability in Conduit Client-Server API

CVE-2024-6303

Summary

A vulnerability exists in the Client-Server API of the Conduit application, allowing unauthorized actions due to missing authorization checks. This issue enables any user to manipulate aliases by adding or removing the #admins alias to different rooms. As a result, an attacker could gain control over a room they do not own, leading to potential privilege escalation. Such unauthorized access could be exploited to execute commands for resetting passwords, signing JSON data with the server's key, deactivating user accounts, and more. Users of Conduit versions prior to 0.8.0 are advised to take immediate action to secure their systems.

References