Northern.tech Mender 3.2.0/3.2.1/3.2.2 Client improper authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in Northern.tech Mender 3.2.0/3.2.1/3.2.2. Affected by this vulnerability is an unknown functionality of the component Client. Such manipulation leads to improper authentication. This vulnerability is traded as CVE-2022-32290. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability was found in Northern.tech Mender 3.2.0/3.2.1/3.2.2 and classified as critical. Affected by this issue is some unknown functionality of the component Client. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server.

The weakness was shared 07/07/2022. The advisory is shared for download at mender.io. This vulnerability is handled as CVE-2022-32290 since 06/05/2022. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Northern.tech

Name

• Mender

Version

• 3.2.0
• 3.2.1
• 3.2.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion