Listen to this Post
The CVE-2024-24788 vulnerability in the github.com/gofiber/utils package arises from the insecure handling of cryptographic random number generator failures. Both the UUIDv4() and UUID() functions rely on crypto/rand.Read() for entropy. When this call fails due to entropy exhaustion or access issues, such as in restricted container environments, the functions silently fall back to predictable values. UUIDv4() indirectly depends on uuid.NewRandom(), which uses crypto/rand.Read(). If uuid.NewRandom() fails, UUIDv4() calls the internal UUID() function without propagating the error. UUID() directly seeds its state via crypto/rand.Read(uuidSeed[:]). If seeding fails, it returns the zero UUID “00000000-0000-0000-0000-000000000000” without alerting the application. This silent failure means that security-critical identifiers like session IDs, CSRF tokens, and authentication tokens become predictable. Attackers can exploit this by causing or waiting for crypto/rand failures, leading to session fixation, CSRF bypass, and authentication replay. The lack of error reporting leaves applications unaware of the compromised security state, making all dependent Fiber middleware vulnerable.
Platform: github.com/gofiber/utils
Version: All versions
Vulnerability: UUID generation failure
Severity: Critical
date: 2024-04-10
Prediction: Patch date TBD
What Undercode Say:
Analytics:
Bash commands:
go list -m all | grep gofiber/utils
go mod why github.com/gofiber/utils
Codes:
func UUIDv4() string {
token, err := uuid.NewRandom()
if err != nil {
return UUID()
}
return token.String()
}
func UUID() string {
uuidSetup.Do(func() {
if _, err := rand.Read(uuidSeed[:]); err != nil {
return
}
uuidCounter = binary.LittleEndian.Uint64(uuidSeed[:8])
})
if atomic.LoadUint64(&uuidCounter) <= 0 {
return “00000000-0000-0000-0000-000000000000”
}
}
how Exploit:
Cause crypto/rand failure. Predict UUIDs. Hijack sessions.
Protection from this CVE
Use uuid.New(). Panic on errors.
Impact:
Session fixation. CSRF bypass. Authentication replay.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
