CVE-2024-39314 (published 2024-07-01T22:15Z)

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/KisaragiEffective/toy-blog
commit_details: repo_url: https://github.com/KisaragiEffective/toy-blog
author: Kisaragi Marine
author_date: 2023-04-15 02:45:51+09:00
msg: fix!: remove --bearer-token
repository: repo_url: https://github.com/KisaragiEffective/toy-blog
repo_name: KisaragiEffective/toy-blog
description: Yet another headless CMS implementation
repo_language: Rust
owner: KisaragiEffective
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,6 @@
 ## How to run
 ```sh
 cargo run -- \
-  --bearer-token=INSERT_YOUR_OWN_PASSWORD \
   --http-host=127.0.0.1 \
   --http-port=8080 \
   --telnet-host=127.0.0.1 \
@@ -13,11 +12,12 @@ cargo run -- \
 ```
 
 ### 解説
-* `--bearer-token`: 記事を更新するときのパスワードを設定する。このパスワードは使い回さないこと。このパスワードは永続化されないので、起動するたびに入力する必要がある。
+* `--bearer-token`: 廃止。標準入力から改行終端で与えること。
 * `--http-host`: HTTPサーバーのホスト。通常は`127.0.0.1`を指定して良い。
 * `--http-port`: HTTPサーバーのポート番号。
 * `--telnet-host`: telnetサーバーのホスト。通常は`127.0.0.1`を指定して良い。
 * `--telnet-port`: telnetサーバーのポート番号。
+* `--read-bearer-token-from-stdin`: 次のメジャーバージョンで廃止予定。このスイッチはもはや互換性のためだけに残されている。
 
 ### 動作させるにあたっての注意事項
 * Cloudflareのトンネルを使っている場合、`--cloudflare`スイッチを付け足すこと。

programming_language: Markdown
filename: main.rs
change_type: ModificationType.MODIFY
diff: @@ -37,9 +37,6 @@ struct Args {
 #[derive(Subcommand)]
 enum Commands {
     Run {
-        /// DEPRECATED
-        #[clap(long)]
-        bearer_token: Option<String>,
         #[clap(long)]
         http_port: u16,
         #[clap(long)]
@@ -50,6 +47,7 @@ enum Commands {
         telnet_host: String,
         #[clap(long = "cloudflare")]
         cloudflare_support: bool,
+        /// DEPRECATED, It will be removed in next major version. This switch is no-op.
         #[clap(long)]
         read_bearer_token_from_stdin: bool,
     },
@@ -86,7 +84,6 @@ async fn main() -> Result<()> {
     let args: Args = Args::parse();
     match args.subcommand {
         Commands::Run {
-            bearer_token,
             http_port,
             http_host,
             telnet_port,
@@ -94,17 +91,11 @@ async fn main() -> Result<()> {
             cloudflare_support,
             read_bearer_token_from_stdin
         } => {
-            let bearer_token = bearer_token.map_or_else(|| if read_bearer_token_from_stdin {
+            let bearer_token = {
                 let mut buf = String::new();
                 stdin().read_line(&mut buf).expect("failed to read from stdin");
                 buf.trim_end().to_string()
-            } else {
-                eprintln!("You must set bearer token to protecting your server.");
-                exit(1)
-            }, |token| {
-                eprintln!("--bearer-token is unsecure. It will be removed by next major release. Please use --read-bearer-token-from-stdin.");
-                token
-            });
+            };
 
             WRITE_TOKEN.set(bearer_token).unwrap();
 

programming_language: Rust