| tiêu đề | Beijing Bairong Qianyu Software Technology Development Co., Ltd. SiteServer CMS 7.2.1 CWE-862 |
|---|
| Mô tả | SSCMS 7.2.1: Improper Authorization in Agent Install Endpoint Allows Administrator Account Creation and Password Reset
Affected Component
SSCMS.Web/Controllers/Admin/AgentController.Install.cs
Vulnerable Endpoint
POST /api/admin/agent/actions/install
Description
The Agent Install endpoint does not require an existing administrator session, JWT, or administrator role. It only compares a request-controlled securityKey value with the configured SecurityKey.
After the key check succeeds, the endpoint allows the requester to:
Create a new administrator account with attacker-controlled credentials
Assign the new account the ConsoleAdministrator role
Reset the password of an existing administrator account
Therefore, the SecurityKey functions as a bearer credential for the entire administrator account-management boundary.
Technical Details
The endpoint accepts:
securityKey
userName
password
The vulnerable flow is:
AgentController.Install
→ compare request.SecurityKey with _settingsManager.SecurityKey
→ call InsertAsync or ChangePasswordAsync
→ assign ConsoleAdministrator role
When the application is already initialized:
If the username exists, the endpoint calls ChangePasswordAsync
If the username does not exist, it calls InsertAsync
The new account is assigned PredefinedRole.ConsoleAdministrator
When the application is not initialized, it calls DatabaseManager.InstallAsync using the attacker-provided username and password.
Proof of Concept
Send:
POST /api/admin/agent/actions/install
with:
{"securityKey":"<valid SecurityKey>","userName":"attacker","password":"<attacker-controlled password>"}
If the account does not exist, a new administrator account is created.
If the username belongs to an existing administrator, the supplied password replaces the existing password.
The endpoint does not require an administrator cookie, JWT, or existing account session.
Impact
An attacker who obtains the SecurityKey may:
Register an arbitrary administrator account
Reset an existing administrator password
Log into the administration panel
Obtain all permissions of a console administrator
Install plugins, modify configuration, access sensitive data, and perform administrative actions
This vulnerability also serves as the privilege-escalation stage for the plugin-loading RCE described in the next entry.
Remediation
Require an authenticated administrator session in addition to any agent secret
Remove account creation and password reset from an externally reachable endpoint
Restrict the endpoint to first-run installation only
Disable the endpoint after initialization
Rotate SecurityKey after installation
Do not use a static configuration secret as the sole authorization mechanism for administrator account operations
Add rate limiting and audit logging
Disclosure Status
Unpatched / fixed version unknown. |
|---|
| Người dùng | BlackSpdier (UID 89912) |
|---|
| Đệ trình | 01/09/2026 03:44 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 10/10/2026 17:09 (1 month later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 397036 [SiteServer SSCMS 7.4.0 Agent Installation Workflow SecurityKey nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|