CVE-2024-53829: CodeChecker Cross-Site Request Forgery Vulnerability
Summary
CVE-2024-53829: Cross-Site Request Forgery in CodeChecker API. Affects codechecker versions < 6.24.5. Fixed in 6.24.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeChecker is an open-source tool designed for static code analysis, enabling developers to identify and rectify potential issues in their codebase. It provides a web API for interaction, allowing users to manage products and configurations. However, it is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability, which can be exploited by attackers to perform unauthorized actions on behalf of authenticated users.
Vulnerability Detail
The vulnerability arises from the absence of security attributes such as HttpOnly and SameSite in the session cookie, which permits its use in XHR requests and form submissions. The CodeChecker API endpoints rely solely on the session cookie for authentication, lacking the requirement for a CSRF token. This oversight allows an attacker to hijack the session of a logged-in user, enabling them to make requests to the API with the same permissions as the user. Although the attacker must know the IDs of products to modify or delete them, they can create new products without such knowledge, posing a significant risk to the integrity of the application.
How To Fix
Latest published version: 6.29.1 as of 23 Oct 2026
pip install --upgrade "codechecker==6.29.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.24.5
This is the first release that contains the fix.
pip install --upgrade "codechecker==6.24.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement CSRF tokens in your API requests and ensure that your session cookies are configured with the HttpOnly and SameSite attributes. This can help mitigate the risk of CSRF attacks until a full update is applied.
Conclusion
The Cross-Site Request Forgery vulnerability in CodeChecker (CVE-2024-53829) poses a significant risk to users by allowing attackers to perform unauthorized actions. It is crucial to update to the patched version (6.24.5 or later) and implement additional security measures to protect against such attacks.
See every vulnerability recorded for codechecker →
FAQ
CSRF is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
An attacker can create a malicious form that submits requests to the CodeChecker API while the victim is logged in, allowing unauthorized actions to be performed.
The attacker can modify, delete, or create products in CodeChecker, potentially leading to data loss or corruption.
Yes, you can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for codechecker.
