what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ImpressCMS 1.4.2 Authentication Bypass

ImpressCMS 1.4.2 Authentication Bypass
Posted Mar 22, 2022
Authored by EgiX | Site karmainsecurity.com

ImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.

tags | exploit, bypass
advisories | CVE-2021-26600
SHA-256 | d8dfe7df740ddc2041569cf9735ee4180779ccae9c55e66d12ed7119dce09379

ImpressCMS 1.4.2 Authentication Bypass

Change Mirror Download
-----------------------------------------------------------------------
ImpressCMS <= 1.4.2 (autologin.php) Authentication Bypass Vulnerability
-----------------------------------------------------------------------


[-] Software Link:

https://www.impresscms.org


[-] Affected Versions:

Version 1.4.2 and prior versions.


[-] Vulnerability Description:

The vulnerability is located in the /plugins/preloads/autologin.php script:

45. $uname = $myts->stripSlashesGPC($autologinName);
46. $pass = $myts->stripSlashesGPC($autologinPass);
47. if (empty($uname) || is_numeric($pass)) {
48. $user = false ;
49. } else {
50. // V3
51. $uname4sql = addslashes($uname);
52. $criteria = new icms_db_criteria_Compo(new
icms_db_criteria_Item('login_name', $uname4sql));
53. $user_handler = icms::handler('icms_member_user');
54. $users = $user_handler->getObjects($criteria, false);
55. if (empty($users) || count($users) != 1) {
56. $user = false ;
57. } else {
58. // V3.1 begin
59. $user = $users[0] ;
60. $old_limit = time() -
(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);
61. list($old_Ynj, $old_encpass) = explode(':', $pass);
62. if (strtotime($old_Ynj) < $old_limit ||
md5($user->getVar('pass') .
63. ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj)
!= $old_encpass)
64. {
65. $user = false;
66. }

User input passed through the "autologin_uname" and "autologin_pass"
cookie values is being used at lines 51-54 to fetch an user object from
the database, and then at lines 62-63 to check the correctness of the
user's password. The vulnerability exists because of an unsafe way of
comparing those parameters, due to comparison operator != is being used
instead of !== within the "if" statement at lines 62-63. The latter
operator returns "true" only if the compared values are equal and the
same type, while the first compares the values after "type juggling".
This might be exploited to potentially bypass the authentication
mechanism and login as any user without the knowledge of the password.


[-] Solution:

Upgrade to version 1.4.3 or later.


[-] Disclosure Timeline:

[20/01/2021] - Vendor notified through HackerOne
[02/02/2021] - Vendor replied this has been resolved and will be in
ImpressCMS 1.4.3
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26600 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Other References:

https://hackerone.com/reports/1081986


[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-01

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close