Integer Overflow in new-api Go Package: Early Warning
- Severity
- HIGH
- Affected component
- github.com/QuantumNous/new-api (go)
- Affected versions
- < 0.12.0-alpha.1 or < 0.10.8-alpha.9 or >= 0.10.0, <= 0.11.9-alpha.1 or < 0.12.0-alpha.1 or < 0.9.6 or < 0.11.4-alpha.2 or <= 0.11.9-alpha.1 or < 0.10.8-alpha.10 or < 0.12.10 or < 0.10.8-alpha.10 or < 0.10.8-alpha.9 or >= 0.10.0 or < 0.11.4-alpha.2 or < 0.12.10 or < 0.12.0-alpha.1 or < 0.12.0-alpha.1
- Patched version
- v1.0.0-rc.19
An integer overflow vulnerability in the quota billing of the new-api Go package has been reported. This vulnerability, which has been exploited in the wild, allows for negative charges due to user-controlled quantity parameters.
What happened
An integer overflow vulnerability has been identified in the quota billing mechanism of the new-api Go package. This vulnerability, tracked as GHSA-8R8V-XF7Q-RCPR, allows for negative charges to be applied due to user-controlled quantity parameters. This issue has reportedly been exploited in the wild, resulting in abnormally inflated balances for affected users.
The vulnerability affects multiple versions of the new-api package, including but not limited to versions less than 0.12.0-alpha.1, 0.10.8-alpha.9, and 0.9.6, among others. The patched version is v1.0.0-rc.19. Users are advised to upgrade to this version to mitigate the risk.
What to do about it
- Upgrade to version v1.0.0-rc.19 of the new-api package immediately.
- Audit your logs for any signs of abuse related to this vulnerability.
- Ensure that all instances of the new-api package in your environment are updated to the patched version.
- Monitor your systems for any unusual activity that may indicate exploitation of this vulnerability.
- Consult the primary sources for the most up-to-date information and additional mitigation steps.
How 0Day would have caught this
github.com/QuantumNous/new-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of the new-api package less than 0.12.0-alpha.1, 0.10.8-alpha.9, or 0.9.6, among other specified versions.
What should I do right now?
Upgrade to version v1.0.0-rc.19 of the new-api package and audit your logs for any signs of abuse.
Has this been exploited in the wild?
Yes, this vulnerability has been reportedly exploited in the wild.