Apache Answer: Predictable Authorization Token Using UUIDv1

Vulnerability

Overview

CVE-2024-45719 describes an inadequate encryption strength vulnerability in Apache Answer, a Q&A platform. The root cause is the use of UUID version 1 (UUIDv1) for generating authorization tokens. UUIDv1 incorporates the current timestamp and the host's MAC address, making tokens predictable if an attacker can observe the generation time or network context [1][2].

Exploitation

An attacker does not need prior authentication to exploit this flaw. By observing one or more valid tokens (e.g., from a public API response or a leaked token), they can deduce the pattern of UUIDv1 generation. With knowledge of the approximate time and the server's MAC address, the attacker can predict future tokens or reconstruct valid tokens for other users. The attack requires network access to the application and the ability to capture at least one token sample [2].

Impact

Successful exploitation allows an attacker to forge authorization tokens, impersonate other users, and gain unauthorized access to accounts, including administrative privileges. This can lead to data disclosure, privilege escalation, and full compromise of the Answer instance [1][2].

Mitigation

The Apache Answer project has released version 1.4.1, which replaces UUIDv1 with a cryptographically secure random token generator. Users are strongly advised to upgrade immediately. No workarounds are available for earlier versions [1][2]. The project's source code is available on GitHub [3].