CVE-2024-26331

HIGHNuclei

ReCrystallize Server - Authentication Bypass

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-26331 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attackers can easily modify the cookie value, within a browser or by implementing client-side code outside of a browser. Attackers can bypass the authentication mechanism by modifying the cookie to contain an expected value.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

recrystallize_server

Browse recrystallize_software / recrystallize_server

Default status: unknown

CVE List5.10.0.0affected

Nuclei templates

1
ProjectDiscoveryHIGHReCrystallize Server - Authentication Bypass

This vulnerability allows an attacker to bypass authentication in the ReCrystallize Server application by manipulating the 'AdminUsername' cookie. This gives the attacker administrative access to the application's functionality, even when the default password has been changed.

Impact

Unauthenticated attackers can bypass authentication by manipulating the AdminUsername cookie to gain administrative access to ReCrystallize Server.

Remediation

Update ReCrystallize Server to a patched version that addresses CVE-2024-26331.

AuthorsCarson Chan
Template tagscverecrystallizeauth-bypasscve2024vuln
Shodan: title:"ReCrystallize"
https://preview.sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/ https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/ https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crystal-Reports.htm https://github.com/Ostorlab/KEV

Source: ProjectDiscovery

References

3