CVE-2024-36048: Qt Network Authorization Vulnerability

CVE-2024-36048 Overview

CVE-2024-36048 is an insecure random number generation vulnerability affecting QAbstractOAuth in Qt Network Authorization. The vulnerable component uses only the current time to seed the pseudorandom number generator (PRNG), resulting in predictable and guessable values. This weakness undermines the security of OAuth implementations that rely on Qt's network authorization module, potentially allowing attackers to predict security tokens and bypass authentication mechanisms.

Critical Impact

Attackers can predict OAuth tokens and security nonces by exploiting the time-based PRNG seeding, potentially leading to complete authentication bypass and unauthorized access to protected resources.

Affected Products

• Qt versions before 5.15.17
• Qt 6.x versions before 6.2.13
• Qt 6.3.x through 6.5.x versions before 6.5.6
• Qt 6.6.x through 6.7.x versions before 6.7.1
• Fedora 39 and Fedora 40

Discovery Timeline

• 2024-05-18 - CVE-2024-36048 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-36048

Vulnerability Analysis

The vulnerability exists in the QAbstractOAuth class within Qt's Network Authorization module. The core issue stems from improper initialization of the pseudorandom number generator (PRNG), which is classified as CWE-335 (Incorrect Usage of Seeds in Pseudo-Random Number Generator). When generating OAuth tokens, nonces, and other security-critical random values, the implementation seeds the PRNG using only the current system time rather than a cryptographically secure entropy source.

This design flaw means that if an attacker can determine or approximate when an OAuth transaction was initiated, they can potentially reproduce the same random sequence. OAuth protocols rely heavily on unpredictable random values for state parameters, nonces, and other anti-forgery mechanisms. When these values become predictable, the security guarantees of the entire OAuth flow are compromised.

Root Cause

The root cause is the use of time-only seeding for the PRNG in QAbstractOAuth. Time-based seeds provide extremely limited entropy—often measured in seconds or milliseconds—which is insufficient for cryptographic applications. An attacker with knowledge of the approximate time window during which a token was generated can enumerate possible seed values and regenerate the random sequence used to create OAuth credentials.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker targeting this vulnerability would:

1. Identify an application using a vulnerable Qt version for OAuth authentication
2. Determine or estimate the time window when the target initiated an OAuth transaction
3. Enumerate possible PRNG seed values based on the suspected timestamp
4. Regenerate the random values used in the OAuth flow (nonces, state parameters, etc.)
5. Use the predicted values to forge authentication requests or hijack OAuth sessions

The attack is particularly effective against high-value OAuth integrations where session tokens or access tokens can be predicted, enabling unauthorized API access or account takeover.

Detection Methods for CVE-2024-36048

Indicators of Compromise

• Unusual patterns of OAuth authentication failures followed by successful authentications from different sources
• Multiple OAuth requests with identical or sequential nonce values
• Authentication tokens appearing in logs that correlate with predictable time-based patterns
• Suspicious access to resources immediately following legitimate OAuth flows from different IP addresses

Detection Strategies

• Implement monitoring for OAuth token reuse or collision detection in authentication logs
• Deploy runtime application security testing (RAST) to identify predictable random value generation
• Use static analysis tools to identify Qt applications using vulnerable qtnetworkauth module versions
• Monitor for anomalous authentication patterns where tokens from one session appear in requests from different network origins

Monitoring Recommendations

• Enable verbose logging for OAuth transactions to capture nonce and state parameter values for analysis
• Implement server-side validation that detects and alerts on duplicate or predictable OAuth state parameters
• Deploy network-level monitoring to detect potential token prediction attacks targeting OAuth endpoints
• Establish baseline metrics for OAuth failure rates and alert on significant deviations that may indicate attack attempts

How to Mitigate CVE-2024-36048

Immediate Actions Required

• Inventory all applications using Qt Network Authorization module and identify vulnerable versions
• Prioritize updating Qt to patched versions: 5.15.17+, 6.2.13+, 6.5.6+, or 6.7.1+
• Review OAuth implementations for additional security controls that may mitigate predictable random values
• Consider implementing additional entropy sources at the application layer as a defense-in-depth measure

Patch Information

Qt has released patches to address this vulnerability. The fixes are available in the official Qt code repository:

• Qt Project Code Review #560317
• Qt Project Code Review #560368

Fedora users should apply available security updates for their respective distributions. Check the Fedora Package Announcements for specific package updates.

Upgrade to the following fixed versions:

• Qt 5.x: Update to version 5.15.17 or later
• Qt 6.2.x: Update to version 6.2.13 or later
• Qt 6.3.x through 6.5.x: Update to version 6.5.6 or later
• Qt 6.6.x through 6.7.x: Update to version 6.7.1 or later

Workarounds

• If immediate patching is not possible, implement server-side nonce validation with strict time-window enforcement
• Add additional application-layer entropy to OAuth token generation processes
• Consider implementing rate limiting on OAuth endpoints to slow down potential token prediction attacks
• Deploy Web Application Firewalls (WAF) with rules to detect suspicious OAuth request patterns

# Check installed Qt version on Linux systems
qmake --version

# Verify qtnetworkauth module version
pkg-config --modversion Qt5NetworkAuth 2>/dev/null || \
pkg-config --modversion Qt6NetworkAuth 2>/dev/null

# Update Qt packages on Fedora
sudo dnf update qt5-qtnetworkauth qt6-qtnetworkauth