CVE-2024-24757
📋 TL;DR
CVE-2024-24757 is an information exposure vulnerability in open-irs where sensitive environment variables from the .env file were accidentally committed to Git repositories. This exposes API keys, credentials, and other secrets to anyone with repository access. Users of open-irs versions before 1.0.1 who have deployed the software are affected.
💻 Affected Systems
- open-irs
📦 What is this software?
Open Irs by Degamisu
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to all secrets stored in .env files, potentially compromising connected systems, databases, APIs, and enabling lateral movement or data exfiltration.
Likely Case
Exposed API keys and credentials are harvested and used for unauthorized access to third-party services or data breaches.
If Mitigated
Limited exposure if secrets were already rotated and .env files contained minimal sensitive data.
🎯 Exploit Status
Exploitation requires access to the Git repository (public or compromised). No special tools needed - just viewing the repository history.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1
Vendor Advisory: https://github.com/Degamisu/open-irs/security/advisories/GHSA-7r69-3vwh-wcfr
Restart Required: No
Instructions:
1. Update open-irs to version 1.0.1 or later. 2. Rotate all exposed secrets immediately. 3. Remove .env files from Git history using git filter-repo or BFG Repo-Cleaner.
🔧 Temporary Workarounds
Remove .env from Git history
allPermanently remove .env files from Git repository history
git filter-repo --path .env --invert-paths
git push origin --force --all
Add .env to .gitignore
allPrevent future commits of .env files
echo '.env' >> .gitignore
git add .gitignore
git commit -m 'Add .env to gitignore'
🧯 If You Can't Patch
- Immediately rotate all secrets that were in .env files
- Implement repository scanning to detect exposed secrets and monitor for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check if .env files exist in Git history: git log --all --full-history -- "**/.env"Check Version:
Check package.json or version file for open-irs versionVerify Fix Applied:
Verify .env files are not in repository: git log --all --full-history -- "**/.env" should return no results📡 Detection & Monitoring
Log Indicators:
- Unauthorized API access using exposed keys
- Failed authentication attempts with rotated credentials
Network Indicators:
- Unexpected outbound connections to services using exposed API keys
SIEM Query:
source="git" AND (file="*.env" OR message="*.env")