Ylianst MeshCentral up to 1.1.20 CSWSH control.ashx origin validation

Summaryinfo

A vulnerability identified as problematic has been detected in Ylianst MeshCentral up to 1.1.20. This issue affects some unknown processing of the file control.ashx of the component CSWSH. The manipulation leads to origin validation. This vulnerability is documented as CVE-2024-26135. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Ylianst MeshCentral up to 1.1.20 and classified as problematic. This issue affects some unknown functionality of the file control.ashx of the component CSWSH. The manipulation with an unknown input leads to a origin validation vulnerability. Using CWE to declare the problem leads to CWE-346. The product does not properly verify that the source of data or communication is valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.

The weakness was released 02/21/2024 as GHSA-cp68-qrhr-g9h8. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-26135 since 02/14/2024. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.1.21 eliminates this vulnerability. Applying the patch f2e43cc6da9f5447dbff0948e6c6024c8a315af3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ylianst

Name

• MeshCentral

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 1.1.18
• 1.1.19
• 1.1.20

License

• open-source

Website

• Product: https://github.com/Ylianst/MeshCentral/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion