Alerta < 8.1.0 - Authentication Bypass

criticalseverity

9.8CVSS score

65.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to Alerta.

Fix

Upgrade Alerta to version 8.1.0 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/api/config
Positive when: compare_versions(version, '< 8.1.0') AND contains "\"alarm_model\"" and "\"actions\"" and "\"severity\"" AND status 200

Run it with nuclei: nuclei -id CVE-2020-26214 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-26214

info:
  name: Alerta < 8.1.0 - Authentication Bypass
  author: CasperGN,daffainfo
  severity: critical
  description: Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to Alerta.
  remediation: |
    Upgrade Alerta to version 8.1.0 or later to mitigate this vulnerability.
  reference:
    - https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
    - https://tools.ietf.org/html/rfc4513#section-5.1.2
    - https://pypi.org/project/alerta-server/8.1.0/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26214
    - https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-26214
    cwe-id: CWE-287
    epss-score: 0.65933
    epss-percentile: 0.99277
    cpe: cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: alerta_project
    product: alerta
  tags: cve,cve2020,alerta,auth-bypass,alerta_project,passive,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/config'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, '< 8.1.0')

      - type: word
        part: body
        words:
          - '"alarm_model"'
          - '"actions"'
          - '"severity"'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '"name": "Alerta ([0-9.]+)"'
        internal: true

      - type: regex
        group: 1
        regex:
          - '"name": "Alerta ([0-9.]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from