CVE-2024-41962: 
JavaScript vulnerability analysis and mitigation

CVE-2024-41962 affects Bostr, a nostr relay aggregator proxy that acts like a regular nostr relay. The vulnerability was discovered and disclosed on August 1, 2024, affecting versions prior to 3.0.10. The issue allows unauthorized access even when authorized_keys are set if the noscraper feature is enabled (GitHub Advisory, NVD).

The vulnerability stems from an improper authorization implementation in the auth.js file. When noscraper is set to true, the system incorrectly allows access to all users, bypassing the authorized_keys check. The vulnerability has been assigned a CVSS v3.1 base score of 6.3 (MEDIUM) by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while GitHub assessed it at 4.6 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L (NVD).

The vulnerability primarily affects private bouncers using the Bostr relay. When exploited, it allows unauthorized users to access the relay even when they are not listed in the authorized_keys configuration, effectively bypassing access controls (GitHub Advisory).

The vulnerability can be exploited remotely by an attacker with low attack complexity. It requires low privileges but may need user interaction according to GitHub's assessment. The vulnerability exists in the authentication mechanism when the noscraper feature is enabled (GitHub Advisory).

Users are advised to upgrade to version 3.0.10 which contains the fix. As a temporary workaround, users can disable the noscraper feature if they have authorized_keys set in their configuration. The fix can be applied through npm using 'npm upgrade bostr@3.0.10' or through source using 'git pull && npm install' (GitHub Release).