CVE-2024-41962
📋 TL;DR
Bostr versions before 3.0.10 have an authentication bypass vulnerability when the noscraper setting is enabled. This allows unauthorized users to access the relay even when authorized_keys are configured, potentially exposing sensitive data. Anyone running Bostr with noscraper=true is affected.
💻 Affected Systems
- Bostr
📦 What is this software?
Bostr by Yonle
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain full access to the nostr relay, potentially reading private messages, impersonating users, or disrupting service integrity.
Likely Case
Unauthorized users bypass authentication to access relay data they shouldn't have permission to view, compromising data confidentiality.
If Mitigated
With proper network segmentation and access controls, impact is limited to the relay service itself rather than broader infrastructure.
🎯 Exploit Status
Exploitation requires no authentication and minimal technical skill - simply connecting to the vulnerable service bypasses authentication checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.10
Vendor Advisory: https://github.com/Yonle/bostr/security/advisories/GHSA-5cf7-cxrf-mq73
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Bostr to version 3.0.10 or later using package manager or manual installation. 3. Restart the Bostr service. 4. Verify the fix by testing authentication functionality.
🔧 Temporary Workarounds
Disable noscraper mode
allSet noscraper configuration to false to prevent the authentication bypass condition
Edit configuration file to set noscraper: false
Restart Bostr service
Network isolation
linuxRestrict network access to Bostr service using firewall rules
iptables -A INPUT -p tcp --dport [BOSTR_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [BOSTR_PORT] -j DROP
🧯 If You Can't Patch
- Disable noscraper mode in configuration immediately
- Implement strict network access controls to limit who can connect to the Bostr service
🔍 How to Verify
Check if Vulnerable:
Check if running Bostr version < 3.0.10 AND noscraper configuration is set to trueCheck Version:
Check package version or run bostr --version if availableVerify Fix Applied:
Test authentication with unauthorized credentials - should be rejected after patch📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts succeeding
- Authentication bypass logs if available
Network Indicators:
- Unexpected connections to Bostr service from unauthorized sources
SIEM Query:
source="bostr" AND (event="auth_bypass" OR event="unauthorized_access")