CVE-2024-11717: medium-severity vulnerability in CTFd
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
CTFd's account activation and password reset tokens can be reused and aren't properly validated, allowing attackers on the same network to intercept and misuse them to take over accounts. The tokens also expose user email addresses in plain sight.
The vulnerability exists in CTFd ≤3.7.4 where reset/activation tokens are transmitted as GET parameters, lack single-use enforcement, and can be reused within their validity window. An on-path attacker can intercept tokens, decode the embedded base64-encoded email, and leverage token interchangeability to execute unauthorized password resets or account takeovers. Mitigation requires token validation improvements and single-use enforcement (addressed in 3.7.5).
In the same product, most dangerous first.