Submit #383224: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-358: Improperly Implemented Security Check for Standard

NOTE - This submit shall be embargoed until 14:00 CET on 2024-08-01 - NOTE

CVE-2024-38884: An issue in Horizon Business Services Inc. Caterease Software allows a local attacker
to perform an Authentication Bypass attack due to improperly implemented security checks for standard
authentication mechanisms.

Vulnerability Type: CWE-358: Improperly Implemented Security Check for Standard

Vendor of the Product: Horizon Business Services Inc.
Affected Product: Caterease Software
Affected Versions: 16.0.1.1663 through 24.0.1.2405

Attack Vector: Local
Attack Type: CAPEC-115: Authentication Bypass

Vulnerability Summary: Caterease Software's Active Directory authentication mechanism has
improperly implemented security checks, allowing local attackers to bypass authentication. Instead of
performing a robust verification with the Active Directory Domain Controller, the application merely
checks if the profile name of the local user matches the Active Directory username set for the Caterease
Software user account. As a result, attackers with the ability to create local profiles can exploit this flaw by
creating a local user with the same profile name as any valid Active Directory user.

This vulnerability enables attackers to gain unauthorized access to Caterease Software user accounts that
have Active Directory authentication enabled. By logging in with a locally created profile that matches an
Active Directory user, attackers can bypass the need for valid Active Directory credentials. This leads to
significant security risks, including data breaches, unauthorized data access, and data manipulation.The
improper implementation of security checks in the Active Directory authentication mechanism
compromises both the confidentiality and integrity of the application.

CVSS Base Score: High Risk - 7.7
CVSS v3.1 Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NA

Exploitability Metrics
Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged

Impact Metrics
Confidentiality (C): High
Integrity (I): High
Availability (A): None

• User: jTag Labs (UID 51246)
• Submission: 07/30/2024 16:54 (2 years ago)
• Moderation: 08/01/2024 14:15 (2 days later)
• Status: Accepted
• VulDB entry: 273368 [Horizon Business Services Caterease up to 24.0.1.2405 Profile Name security check]
• Points: 17