CVE-2024-41264: 
vulnerability analysis and mitigation

An issue was discovered in casdoor v1.636.0 that allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. The vulnerability affects versions up to and including 1.636.0 of the casdoor software (GitHub Advisory).

The vulnerability stems from the usage of ssh.InsecureIgnoreHostKey() in casdoor/casdoor/object/viaSSHDialer.go when establishing SSH connections. This method disables host key verification, which effectively ignores any potential discrepancies between the expected and actual host keys. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. It is classified under CWE-295 (Improper Certificate Validation) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

The vulnerability can lead to information disclosure through man-in-the-middle attacks. By disabling host key checking, attackers could potentially impersonate the intended server during SSH connections when connecting to MySQL, PostgreSQL, or MSSQL databases (GitHub Advisory).

The vulnerability is remotely exploitable and requires no user interaction or special privileges. The attack vector involves exploiting SSH connections to database systems (GitHub Advisory).

Users should avoid using versions >=1.541.0,<=1.636.0 of the casdoor package (FortiGuard Labs).