CVE-2023-50974: Apprite CLI makes Use of Hard-coded Credentials

January 9, 2024 (updated September 13, 2024)

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.

References

appwrite.io/docs/tooling/command-line/installation
gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d
github.com/advisories/GHSA-g777-crp9-m27g
github.com/appwrite/sdk-for-cli
github.com/pypa/advisory-database/tree/main/vulns/appwrite/PYSEC-2024-2.yaml
nvd.nist.gov/vuln/detail/CVE-2023-50974

Code Behaviors & Features

Detect and mitigate CVE-2023-50974 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →