CVE-2024-37767: 14Finger Auth Bypass Vulnerability

CVE-2024-37767 Overview

CVE-2024-37767 is an insecure permissions vulnerability in 14Finger v1.1, an open-source web fingerprinting tool maintained by b1ackc4t. The flaw resides in the /api/admin/user API endpoint, which fails to enforce authentication and authorization checks. Attackers can issue a crafted GET request to retrieve information about all users registered in the application. The issue is tracked under CWE-306: Missing Authentication for Critical Function and exposes sensitive account data to unauthenticated network attackers.

Critical Impact
Unauthenticated remote attackers can enumerate all user accounts managed by 14Finger v1.1, leading to disclosure of credentials metadata and administrative user details.

Affected Products

b1ackc4t 14Finger version 1.1
Deployments exposing the /api/admin/user endpoint to untrusted networks
Self-hosted instances based on the affected upstream release

Discovery Timeline

2024-07-05 - CVE-2024-37767 published to the National Vulnerability Database
2025-07-01 - Last updated in NVD database

Technical Details for CVE-2024-37767

Vulnerability Analysis

14Finger is a web application fingerprinting framework that exposes a REST API for managing users and scan data. The /api/admin/user endpoint is intended for administrative use, returning account records for users registered with the platform.

In version 1.1, the endpoint does not validate the requester's identity or role before returning data. A simple GET request reaches the handler and receives the full user list. The vulnerability falls under the Broken Access Control category and maps to CWE-306, Missing Authentication for Critical Function.

The EPSS score for this issue is 0.396% at the 31.144 percentile, indicating limited observed exploitation activity at this time.

Root Cause

The root cause is the absence of an authentication or authorization middleware on the administrative API route. The handler treats the request as trusted regardless of session state, JWT presence, or role membership. Any client able to reach the API over the network can read administrative data, including usernames and related account fields exposed by the endpoint.

Attack Vector

Exploitation requires only network access to the 14Finger instance. The attacker sends a GET request to /api/admin/user without credentials, cookies, or tokens. The server responds with a JSON payload containing user records. No user interaction, social engineering, or privilege is required. Internet-exposed deployments are at the highest risk, but internal instances are equally vulnerable to attackers with lateral access. Refer to the GitHub issue tracking this report for the original disclosure discussion.

Detection Methods for CVE-2024-37767

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/admin/user in web server access logs
Anomalous response sizes from the /api/admin/user endpoint indicating bulk user record disclosure
Requests to administrative API paths originating from unfamiliar IP addresses or automated user agents

Detection Strategies

Inspect application and reverse proxy logs for GET requests to /api/admin/user lacking an Authorization header or valid session cookie
Deploy WAF rules that flag access to administrative API routes from non-allowlisted source addresses
Correlate scanning patterns that probe multiple 14Finger API paths in short timeframes

Monitoring Recommendations

Enable verbose request logging on the 14Finger backend and forward logs to a central analytics platform
Alert on HTTP 200 responses to /api/admin/* paths originating from unauthenticated sessions
Track outbound data volumes from the application server to identify large user data exfiltration attempts

How to Mitigate CVE-2024-37767

Immediate Actions Required

Remove /api/admin/user and other administrative endpoints from public network exposure using firewall or reverse proxy rules
Restrict access to 14Finger instances to trusted VPN or bastion networks until a fix is in place
Rotate credentials for any accounts that may have been disclosed through the affected endpoint

Patch Information

At the time of writing, no official patched release has been published by the upstream project. Track the vendor issue on GitHub for remediation updates and apply maintainer-provided fixes once available.

Workarounds

Place 14Finger behind an authenticating reverse proxy that enforces session validation for all /api/admin/* routes
Add a network ACL or nginxlocation block that denies external access to administrative API paths
Disable or remove the affected component if administrative API functionality is not required in the deployment

bash

# Configuration example: nginx location block restricting the admin API
location /api/admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://14finger_backend;
}