Horizon Business Services Caterease up to 24.0.1.2405 User Password hash without salt

Summaryinfo

A vulnerability, which was classified as critical, has been found in Horizon Business Services Caterease up to 24.0.1.2405. This issue affects some unknown processing of the component User Password Handler. The manipulation leads to hash without salt. This vulnerability is referenced as CVE-2024-38881. The attack needs to be initiated within the local network. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). It has been rated as problematic. This issue affects an unknown functionality of the component User Password Handler. The manipulation with an unknown input leads to a hash without salt vulnerability. Using CWE to declare the problem leads to CWE-759. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input. Impacted is confidentiality. The summary by CVE is:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords.

The bug was discovered 04/06/2024. The weakness was published by Austin Henderson (CerebralStud) with jTag Labs as security advisory (VulDB). The public release has been coordinated with Horizon Business Services. Caterease stores user password hashes without salts, making them vulnerable to rainbow table attacks. This vulnerability arises because the application fails to use a cryptographic salt when hashing passwords, a critical security measure designed to protect against precomputed hash attacks. An attacker can exploit this vulnerability by precomputing hash values for a wide range of possible passwords and then comparing them to the stored hashes. Once a match is found, the original password can be recovered, leading to unauthorized access to user accounts. The identification of this vulnerability is CVE-2024-38881 since 06/21/2024. The exploitation is known to be difficult. The attack can only be done within the local network. No form of authentication is needed for a successful exploitation. Technical details are unknown but a private exploit is available. MITRE ATT&CK project uses the attack technique T1110.002 for this issue.

A private exploit has been developed by CerebralStud in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 118 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by CerebralStud and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. To exploit this vulnerability, an attacker can utilize the Caterease user creation feature to hash known passwords and save them to the database. By automating this process with Python, the attacker can import a wordlist, create user accounts, and store the corresponding unsalted password hashes in the database. These hashes can later be exported and used to crack any Caterease user password hash through a rainbow table attack.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383217: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-759: Use of a One-Way Hash without a Salt (by jTag Labs)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion