Reprise License Manager 14.2 - Authentication Bypass

criticalseverity

9.8CVSS score

58.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Reprise License Manager (RLM) 14.2 does not verify authentication or authorization and allows unauthenticated users to change the password of any existing user.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Reprise License Manager.

Fix

Apply the latest security patch or upgrade to a patched version of Reprise License Manager to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/goforms/menu
Positive when: contains "RLM Administration Commands" AND status 200

Run it with nuclei: nuclei -id CVE-2021-44152 -u <target>

The full check

id: CVE-2021-44152

info:
  name: Reprise License Manager 14.2 - Authentication Bypass
  author: Akincibor
  severity: critical
  description: |
    Reprise License Manager (RLM) 14.2 does not verify authentication or authorization and allows unauthenticated users to change the password of any existing user.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the Reprise License Manager.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of Reprise License Manager to mitigate this vulnerability.
  reference:
    - https://reprisesoftware.com/admin/rlm-admin-download.php?&euagree=yes
    - http://packetstormsecurity.com/files/165186/Reprise-License-Manager-14.2-Unauthenticated-Password-Change.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44152
    - https://www.reprisesoftware.com/RELEASE_NOTES
    - https://github.com/anonymous364872/Rapier_Tool
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-44152
    cwe-id: CWE-306
    epss-score: 0.58555
    epss-percentile: 0.99108
    cpe: cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: reprisesoftware
    product: reprise_license_manager
    shodan-query:
      - http.html:"Reprise License Manager"
      - http.html:"reprise license"
      - http.html:"reprise license manager"
    fofa-query:
      - body="reprise license manager"
      - body="reprise license"
    google-query: inurl:"/goforms/menu"
  tags: cve,cve2021,packetstorm,rlm,auth-bypass,reprisesoftware,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/goforms/menu"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "RLM Administration Commands"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from