CVE-2020-26214

Nuclei

LDAP authentication bypass in Alerta

Title source: CVE List
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2020-26214.

Description

In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

alerta

Browse alerta / alerta
CVE List< 8.1.0affected

alerta-server

Browse PyPI / alerta-server
GitHub Advisory8.0.0 to < 8.1.0 · Fixed in 8.1.0affected
Before 7.5.7 · Fixed in 7.5.7affected

Nuclei templates

1
ProjectDiscoveryCRITICALAlerta < 8.1.0 - Authentication BypassCVSS 9.8

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to Alerta.

Remediation

Upgrade Alerta to version 8.1.0 or later to mitigate this vulnerability.

WeaknessesCWE-287
AuthorsCasperGN, daffainfo
Template tagscvecve2020alertaauth-bypassalerta_projectpassivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
https://github.com/advisories/GHSA-5hmm-x8q8-w5jh https://tools.ietf.org/html/rfc4513#section-5.1.2 https://pypi.org/project/alerta-server/8.1.0/ https://nvd.nist.gov/vuln/detail/CVE-2020-26214 https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65

Source: ProjectDiscovery

References

9