CVE-2024-55215

An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register

Critical · published February 7, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

🚨 A remote attacker can exploit a single interface to escalate their privileges! This is like someone hacking into the front desk of a hotel and suddenly being given access to any room they want! 🚪🔥 Imagine a hotel where the front desk gives guests access to any room just by asking, without verifying if they are, in fact, authorized. This vulnerability allows attackers to do just that - gain unnecessary access where they shouldn’t be able to! An attacker exploiting this vulnerability could gain elevated privileges within the system, potentially taking control of sensitive operations, accessing private data, or making unauthorized changes. This could lead to catastrophic consequences for any organization relying on this software!

Put simply

Imagine a hotel where the front desk gives guests access to any room just by asking, without verifying if they are, in fact, authorized. This vulnerability allows attackers to do just that - gain unnecessary access where they shouldn’t be able to! The vulnerability in trojan versions 2.0.0 through 2.15.3 allows remote attackers to escalate privileges through the initialization interface during the registration process, bypassing necessary security checks.

What to do

An attacker exploiting this vulnerability could gain elevated privileges within the system, potentially taking control of sensitive operations, accessing private data, or making unauthorized changes. This could lead to catastrophic consequences for any organization relying on this software! To remediate this critical vulnerability, immediately upgrade to trojan version 2.15.4 or higher. Additionally, review access controls and ensure that proper authentication mechanisms are enforced at the registration interface. You've got this! By following these steps, you can secure your system and protect against unauthorized access! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01372 · 71.7th percentile
Published
2025-02-07T00:00Z
EPSS history
Timeline
  • 07 FEB 00:00Z
    An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register
    cvelistv5