Is CVE-2023-50974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-50974 being exploited in the wild.

How severe is CVE-2023-50974?

Low severity, with a CVSS score of 3.1, published 9 January 2024.

Which products and versions are affected?

appwrite-cli (npm) SEMVER:introduced=0,fixed=3.0.0; appwrite (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.0.

Is there a fix for CVE-2023-50974?

Yes. appwrite-cli (npm): upgrade to 3.0.0 or later; appwrite (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-50974 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2023-50974?

Check whether you run appwrite-cli (npm) or appwrite (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-50974: Appwrite CLI insecure credential storage in configuration file

CVE-2023-50974 · Severity: low · CVSS 3.1 · Published 2024-01-09

The Appwrite CLI is a command-line tool used by developers to manage Appwrite backend services. When users log in via the CLI, their credentials are stored in a configuration file with overly permissive file permissions (0644), allowing any local user on the same system to read and steal those credentials. This could lead to unauthorized access to Appwrite projects and data.

Vendors: npm, PyPI.

Quick answers

Is CVE-2023-50974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-50974 being exploited in the wild.
How severe is CVE-2023-50974?: Low severity, with a CVSS score of 3.1, published 9 January 2024.
Which products and versions are affected?: appwrite-cli (npm) SEMVER:introduced=0,fixed=3.0.0; appwrite (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.0.
Is there a fix for CVE-2023-50974?: Yes. appwrite-cli (npm): upgrade to 3.0.0 or later; appwrite (PyPI): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-50974 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2023-50974?: Check whether you run appwrite-cli (npm) or appwrite (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

appwrite-cli (npm): upgrade to 3.0.0 or later
```
npm install appwrite-cli@3.0.0
```
appwrite (PyPI): upgrade to 3.0.0 or later
```
pip install "appwrite>=3.0.0"
```

Technical details

The vulnerability is a hardcoded credential exposure issue (CWE-798) affecting Appwrite CLI versions before 3.0.0. When the login command is executed, user credentials are persisted to ~/.appwrite/prefs.json with UNIX file permissions 0644, making the file readable by all local users on a multi-user system. This is a local attack vector requiring only the ability to log into the system as a non-root user. An attacker can read the stored credentials and use them to authenticate to the Appwrite backend, gaining full access to the victim's projects. The vulnerability has been fixed in version 3.0.0 by implementing secure credential storage with restricted file permissions.

Affected products

Appwrite CLI before 3.0.0

Identifiers

CVE-2023-50974
GHSA-g777-crp9-m27g
PYSEC-2024-2

Timeline

2024-01-09: disclosed
2024-01-09: patched: Fixed in version 3.0.0

References

https://appwrite.io/docs/tooling/command-line/installation

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.