CVE-2024-53829 Overview
CVE-2024-53829 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Ericsson CodeChecker through version 6.24.4. CodeChecker is an analyzer tooling, defect database, and viewer extension for the Clang Static Analyzer and Clang Tidy. The flaw allows an unauthenticated attacker to hijack the authentication of a logged-in user and invoke the web API with that user's permissions. Successful exploitation enables adding, removing, or editing products through the CodeChecker interface. The attacker cannot directly exfiltrate data due to the form-based nature of the CSRF attack, but must know the ID of the targeted product to modify or delete it. The issue is tracked under [CWE-352].
Critical Impact
Attackers can silently trigger administrative actions against products managed in CodeChecker by tricking an authenticated user into visiting an attacker-controlled page.
Affected Products
- Ericsson CodeChecker versions through 6.24.4
- Deployments exposing the CodeChecker web interface to authenticated users
- Environments where administrators or product owners are logged into CodeChecker
Discovery Timeline
- 2025-01-21 - CVE-2024-53829 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-53829
Vulnerability Analysis
The vulnerability stems from missing anti-CSRF protections on state-changing endpoints within CodeChecker's web API. When a user is authenticated to CodeChecker, the browser automatically attaches session credentials to any request originating from another origin. Because the API accepts form-based requests without validating an anti-CSRF token or origin, an attacker's page can issue product management requests on behalf of the victim. The vulnerability is classified under [CWE-352] Cross-Site Request Forgery.
The scope change reflected in the CVSS vector indicates that a compromised web session can affect resources beyond the vulnerable component itself. Impacted actions include product creation, modification, and deletion. Direct data exfiltration is not possible through this vector because the attacker is limited to submitting forms rather than reading responses across origins.
Root Cause
CodeChecker's server-side request handling does not verify that state-changing HTTP requests originate from a trusted context. There is no synchronizer token, no double-submit cookie, and no strict origin or referer validation applied to product management endpoints through version 6.24.4.
Attack Vector
An attacker crafts a malicious HTML page containing an auto-submitting form pointed at a CodeChecker product management endpoint. When an authenticated administrator visits the page, the browser transmits the request with valid session cookies. Because the attacker must reference specific product identifiers, reconnaissance or predictable IDs are required to target existing products for modification or deletion.
No verified public proof-of-concept has been released. The vulnerability mechanism is described in the Ericsson GitHub Security Advisory GHSA-f8c8-4pm7-w885.
Detection Methods for CVE-2024-53829
Indicators of Compromise
- Unexpected creation, modification, or deletion of products in CodeChecker audit logs
- Product management API requests with Origin or Referer headers pointing to unrelated external domains
- Product configuration changes originating from user sessions during periods of normal browsing activity
Detection Strategies
- Inspect web server access logs for POST requests to CodeChecker product endpoints with mismatched or missing Referer headers
- Correlate administrative product changes with authenticated user browser activity to identify actions not initiated from the CodeChecker UI
- Alert on bursts of product delete or edit operations tied to a single user session
Monitoring Recommendations
- Enable and centralize CodeChecker application and access logs for retention and search
- Monitor authenticated session activity for cross-origin request patterns using a web application firewall
- Baseline normal administrative activity and flag deviations in product API usage
How to Mitigate CVE-2024-53829
Immediate Actions Required
- Upgrade CodeChecker to a version later than 6.24.4 that addresses [CWE-352]
- Restrict access to the CodeChecker web interface to trusted networks or VPN clients
- Instruct administrators to log out of CodeChecker when not actively using it and to avoid browsing untrusted sites in the same browser session
Patch Information
Refer to the Ericsson GitHub Security Advisory GHSA-f8c8-4pm7-w885 for fixed release information and upgrade guidance. Apply the vendor-supplied update to all CodeChecker instances that expose the web API.
Workarounds
- Place CodeChecker behind a reverse proxy that enforces strict Origin and Referer header validation on state-changing requests
- Require re-authentication or step-up authentication before product management operations where feasible
- Use browser session isolation for administrators managing CodeChecker to prevent cross-site request piggybacking
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
