CVE-2024-36277
📋 TL;DR
This vulnerability in the FreeFrom nostr client allows attackers to inject malicious event data with invalid cryptographic signatures that the app cannot detect. This affects all Android and iOS users running versions prior to 1.3.5, potentially compromising the integrity of their nostr communications.
💻 Affected Systems
- FreeFrom - the nostr client
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could inject fake messages, impersonate users, or spread misinformation through the nostr network, undermining trust in the platform.
Likely Case
Malicious actors could post unauthorized content appearing to come from legitimate users, causing reputation damage and confusion.
If Mitigated
With proper signature verification, only properly signed events from authenticated users would be accepted.
🎯 Exploit Status
Exploitation requires crafting nostr events with invalid signatures, which is technically straightforward for attackers familiar with the protocol.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.5
Vendor Advisory: https://jvn.jp/en/jp/JVN55045256/
Restart Required: Yes
Instructions:
1. Open Google Play Store or Apple App Store. 2. Search for 'FreeFrom - the nostr client'. 3. Update to version 1.3.5 or later. 4. Restart the app.
🔧 Temporary Workarounds
Disable app until patched
allTemporarily stop using the vulnerable app version
Use alternative nostr client
allSwitch to a different nostr client application that properly verifies signatures
🧯 If You Can't Patch
- Monitor for unusual activity or unexpected messages in the app
- Verify important messages through alternative communication channels
🔍 How to Verify
Check if Vulnerable:
Check app version in settings: if version is below 1.3.5, you are vulnerable.Check Version:
Open FreeFrom app → Settings → About or App InfoVerify Fix Applied:
Confirm app version is 1.3.5 or higher in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual message patterns
- Messages from users that don't match their typical behavior
Network Indicators:
- Unexpected nostr event traffic with unusual signature patterns
SIEM Query:
Not applicable for mobile app vulnerability🔗 References
- https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
- https://freefrom.space/
- https://jvn.jp/en/jp/JVN55045256/
- https://play.google.com/store/apps/details?id=com.freefrom
- https://apps.apple.com/us/app/freefrom-the-nostr-client/id6446819930
- https://freefrom.space/
- https://jvn.jp/en/jp/JVN55045256/
- https://play.google.com/store/apps/details?id=com.freefrom
