Description

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks (eg. public wifi, malicious DNS servers) may have all GraphQL request and response headers and bodies fully compromised including authorization tokens. The attack also allows obtaining full access to any signed-in Altair GraphQL Cloud account and replacing payment checkout pages with a malicious website. Version 8.0.5 fixes the issue.

Classification

CVE ID: CVE-2024-54147

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.8

Affected Products

Vendor: altair-graphql

Product: altair

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.44% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://github.com/altair-graphql/altair/security/advisories/GHSA-8v9h-hxp5-9jcx
https://github.com/altair-graphql/altair/blob/004f645d1cae032787fccf7166dc193b775e9660/packages/altair-electron/src/app/index.ts#L162-L170

Timeline