CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
5964 vulnerabilities reference this CWE, most recent first.
GHSA-WQ59-4Q6R-635R
Vulnerability from github – Published: 2023-12-19 23:37 – Updated: 2023-12-21 15:58Summary
A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret".
The vulnerability can only be exploited on instances that have never been restarted.
Details
Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a jwt query parameter instead of the traditional password or token and salt (corresponding to resp. the p or t and s query parameters).
During the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the sub claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: "not so secret".
A bug in the order of operations during navidrome startup results in the authentication module initializing before the module responsible for generating and persisting the random key. As a consequence, the authentication module falls back to using the hardcoded value, which remains in use until the instance gets restarted. Additionally, an error that was meant to be logged when the fallback value is used does not get logged due to another bug, preventing the operator from becoming aware of the issue.
The flaw allows the creation of a JWT with the sub claim set to any existing user on the server, signed with the key "not so secret", which can then be used to authenticate against the subsonic endpoint with the chosen user's privileges.
After navidrome is restarted, the random key generated during the previous startup is loaded and the flaw becomes inexploitable.
PoC
Generate a JWT token with the subject "admin", and key "not so secret" (e.g. online on: http://jwtbuilder.jamiekurtz.com; the other parameters can be left in, it doesn't seem that navidrome validates anything). In a shell, assign the token to the variable JWT (for the curl commands below).
$ podman run -d --name navidrome -p 127.0.0.1:4533:4533 -e ND_DEVAUTOCREATEADMINPASSWORD=password docker.io/deluan/navidrome:0.50.1
$ curl "http://localhost:4533/rest/ping.view?c=dummy&v=1&u=admin&jwt=$JWT"
<subsonic-response xmlns="http://subsonic.org/restapi" status="ok" version="1.16.1" type="navidrome" serverVersion="0.50.1 (f69c27d1)" openSubsonic="true"></subsonic-response>
The ND_DEVAUTOCREATEADMINPASSWORD parameter does not influence the bypass, it also works if the admin or extra users are created manually after starting navidrome.
Restarting navidrome prevents the bypass:
$ podman restart navidrome
$ curl "http://localhost:4533/rest/ping.view?c=dummy&v=1&u=admin&jwt=$JWT"
<subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="navidrome" serverVersion="0.50.1 (f69c27d1)" openSubsonic="true"><error code="40" message="Wrong username or password"></error></subsonic-response>
Impact
This authentication bypass vulnerability potentially affects all instances that don't protect the subsonic endpoint /rest/, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected).
The impact is limited by the fact that the flaw becomes inexploitable after a first restart, and the attacker needs to know the username of existing users on the instance.
For each known user, the attacker could mess with (create/delete/change) playlists, bookmarks, media annotations, shares (which are currently global) and radios. He is also able to get the user's email address (which is PII) with the getUser operation. And lastly he can use the media retrieval operations which could potentially affect the availability of the system.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.50.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.50.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-51442"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-19T23:37:45Z",
"nvd_published_at": "2023-12-21T15:15:13Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\".\n\nThe vulnerability can only be exploited on instances that have never been restarted.\n\n### Details\n\nNavidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters).\n\nDuring the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the `sub` claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: \"not so secret\".\n\nA bug in the order of operations during navidrome startup results in the authentication module initializing before the module responsible for generating and persisting the random key. As a consequence, the authentication module falls back to using the hardcoded value, which remains in use until the instance gets restarted. Additionally, an error that was meant to be logged when the fallback value is used does not get logged due to another bug, preventing the operator from becoming aware of the issue.\n\nThe flaw allows the creation of a JWT with the `sub` claim set to any existing user on the server, signed with the key \"not so secret\", which can then be used to authenticate against the subsonic endpoint with the chosen user\u0027s privileges.\n\nAfter navidrome is restarted, the random key generated during the previous startup is loaded and the flaw becomes inexploitable.\n\n### PoC\n\nGenerate a JWT token with the subject \"admin\", and key \"not so secret\" (e.g. online on: http://jwtbuilder.jamiekurtz.com; the other parameters can be left in, it doesn\u0027t seem that navidrome validates anything). In a shell, assign the token to the variable `JWT` (for the curl commands below).\n\n```\n$ podman run -d --name navidrome -p 127.0.0.1:4533:4533 -e ND_DEVAUTOCREATEADMINPASSWORD=password docker.io/deluan/navidrome:0.50.1\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"ok\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003c/subsonic-response\u003e\n```\n\nThe `ND_DEVAUTOCREATEADMINPASSWORD` parameter does not influence the bypass, it also works if the admin or extra users are created manually after starting navidrome.\n\nRestarting navidrome prevents the bypass:\n\n```\n$ podman restart navidrome\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"failed\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003cerror code=\"40\" message=\"Wrong username or password\"\u003e\u003c/error\u003e\u003c/subsonic-response\u003e\n```\n\n### Impact\n\nThis authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected).\n\nThe impact is limited by the fact that the flaw becomes inexploitable after a first restart, and the attacker needs to know the username of existing users on the instance.\n\nFor each known user, the attacker could mess with (create/delete/change) playlists, bookmarks, media annotations, shares (which are currently global) and radios. He is also able to get the user\u0027s email address (which is PII) with the `getUser` operation. And lastly he can use the media retrieval operations which could potentially affect the availability of the system.",
"id": "GHSA-wq59-4q6r-635r",
"modified": "2023-12-21T15:58:09Z",
"published": "2023-12-19T23:37:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51442"
},
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Authentication bypass vulnerability in navidrome\u0027s subsonic endpoint"
}
GHSA-WQ5J-2JWC-3H38
Vulnerability from github – Published: 2024-01-09 03:30 – Updated: 2024-01-12 15:30Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
{
"affected": [],
"aliases": [
"CVE-2023-51717"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T02:15:45Z",
"severity": "CRITICAL"
},
"details": "Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.",
"id": "GHSA-wq5j-2jwc-3h38",
"modified": "2024-01-12T15:30:25Z",
"published": "2024-01-09T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51717"
},
{
"type": "WEB",
"url": "https://dataiku.com"
},
{
"type": "WEB",
"url": "https://doc.dataiku.com/dss/latest/security/advisories/dsa-2023-010.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WQ9F-W2RJ-J5WC
Vulnerability from github – Published: 2022-10-19 12:00 – Updated: 2026-05-27 18:31Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2022-21618"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-18T21:15:00Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"id": "GHSA-wq9f-w2rj-j5wc",
"modified": "2026-05-27T18:31:34Z",
"published": "2022-10-19T12:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21618"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-25"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221028-0012"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WQFV-XX2R-H6V5
Vulnerability from github – Published: 2022-05-17 00:36 – Updated: 2022-05-17 00:36The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
{
"affected": [],
"aliases": [
"CVE-2017-7649"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-11T16:29:00Z",
"severity": "CRITICAL"
},
"details": "The network enabled distribution of Kura before 2.1.0 takes control over the device\u0027s firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox \"exec\" command. As the process is running as \"root\" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.",
"id": "GHSA-wqfv-xx2r-h6v5",
"modified": "2022-05-17T00:36:10Z",
"published": "2022-05-17T00:36:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7649"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/kura/issues/956"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WQVR-3MQV-M62M
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:54The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.
{
"affected": [],
"aliases": [
"CVE-2018-19999"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-07T17:29:00Z",
"severity": "HIGH"
},
"details": "The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.",
"id": "GHSA-wqvr-3mqv-m62m",
"modified": "2024-04-04T00:54:08Z",
"published": "2022-05-24T16:47:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19999"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2019/May/46"
},
{
"type": "WEB",
"url": "https://www.themissinglink.com.au/security-advisories-cve-2018-19999"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR2V-9RPQ-C35Q
Vulnerability from github – Published: 2024-01-31 00:21 – Updated: 2024-01-31 00:21Vulnerability type
Cryptography
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.
References
Find out more on this vulnerability in the security audit report
For more information
If you have any questions or comments about this advisory: * Contact the etcd security committee
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.4.9"
},
"package": {
"ecosystem": "Go",
"name": "go.etcd.io/etcd"
},
"ranges": [
{
"events": [
{
"introduced": "3.4.0-rc.0"
},
{
"fixed": "3.4.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "go.etcd.io/etcd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-15136"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T00:21:56Z",
"nvd_published_at": "2020-08-06T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Vulnerability type\nCryptography\n\n### Workarounds\nRefer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.\n\n### Detail\nWhen starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.\n \n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)",
"id": "GHSA-wr2v-9rpq-c35q",
"modified": "2024-01-31T00:21:56Z",
"published": "2024-01-31T00:21:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15136"
},
{
"type": "WEB",
"url": "https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records"
}
GHSA-WR3W-7FJ6-QVCR
Vulnerability from github – Published: 2022-05-14 01:59 – Updated: 2022-05-14 01:59FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.
{
"affected": [],
"aliases": [
"CVE-2018-16590"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-06T23:29:00Z",
"severity": "CRITICAL"
},
"details": "FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.",
"id": "GHSA-wr3w-7fj6-qvcr",
"modified": "2022-05-14T01:59:36Z",
"published": "2022-05-14T01:59:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16590"
},
{
"type": "WEB",
"url": "https://cyberskr.com/blog/furuno-felcom.html"
},
{
"type": "WEB",
"url": "https://gist.github.com/CyberSKR/34a8d6be7646a4bfd4df455f9f52500f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR59-7JHH-RQ3Q
Vulnerability from github – Published: 2023-08-31 21:32 – Updated: 2023-08-31 21:32Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.
{
"affected": [],
"aliases": [
"CVE-2023-41751"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-31T21:15:08Z",
"severity": "MODERATE"
},
"details": "Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.",
"id": "GHSA-wr59-7jhh-rq3q",
"modified": "2023-08-31T21:32:41Z",
"published": "2023-08-31T21:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41751"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-5615"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WR75-9GVH-9GH6
Vulnerability from github – Published: 2023-02-16 21:30 – Updated: 2023-03-06 21:30Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2022-32570"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-16T20:15:00Z",
"severity": "HIGH"
},
"details": "Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-wr75-9gvh-9gh6",
"modified": "2023-03-06T21:30:18Z",
"published": "2023-02-16T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32570"
},
{
"type": "WEB",
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00714.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR8V-6JGR-244V
Vulnerability from github – Published: 2021-12-27 00:01 – Updated: 2022-07-13 00:01Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000 before 2021-08-27, R6220 before 2021-08-27, R6230 before 2021-08-27, R6260 before 2021-08-27, R6330 before 2021-08-27, R6350 before 2021-08-27, R6700v2 before 2021-08-27, R6800 before 2021-08-27, R6850 before 2021-08-27, R6900v2 before 2021-08-27, R7200 before 2021-08-27, R7350 before 2021-08-27, R7400 before 2021-08-27, and R7450 before 2021-08-27.
{
"affected": [],
"aliases": [
"CVE-2021-45511"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-26T01:15:00Z",
"severity": "CRITICAL"
},
"details": "Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000 before 2021-08-27, R6220 before 2021-08-27, R6230 before 2021-08-27, R6260 before 2021-08-27, R6330 before 2021-08-27, R6350 before 2021-08-27, R6700v2 before 2021-08-27, R6800 before 2021-08-27, R6850 before 2021-08-27, R6900v2 before 2021-08-27, R7200 before 2021-08-27, R7350 before 2021-08-27, R7400 before 2021-08-27, and R7450 before 2021-08-27.",
"id": "GHSA-wr8v-6jgr-244v",
"modified": "2022-07-13T00:01:51Z",
"published": "2021-12-27T00:01:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45511"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000063961/Security-Advisory-for-Authentication-Bypass-Vulnerability-on-the-D7000-and-Some-Routers-PSV-2021-0133"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.