Horizon Business Services Caterease up to 24.0.1.2405 Login excessive authentication

Summaryinfo

A vulnerability categorized as problematic has been discovered in Horizon Business Services Caterease up to 24.0.1.2405. Affected by this vulnerability is an unknown functionality of the component Login. The manipulation results in excessive authentication. This vulnerability is reported as CVE-2024-38888. The attack requires a local approach. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Horizon Business Services Caterease up to 24.0.1.2405 (Hospitality Software). It has been classified as problematic. Affected is an unknown functionality of the component Login. The manipulation with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality. CVE summarizes:

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts.

The bug was discovered 04/02/2024. The weakness was disclosed by Calvin Star (Skelet4r) with jTag Labs as security advisory (VulDB). The public release has been coordinated in cooperation with the vendor. Caterease lacks adequate controls to prevent excessive authentication attempts, making it susceptible to brute force attacks. The login mechanism in Caterease activates the "OK" button only when a correct password is entered, allowing attackers to test passwords without actually sending them to the server. This design flaw enables attackers to systematically try numerous password combinations until they find the correct one, effectively bypassing standard security measures that should limit failed login attempts. This vulnerability is traded as CVE-2024-38888 since 06/21/2024. The exploitability is told to be difficult. The attack needs to be approached locally. Technical details are unknown but a private exploit is available. The MITRE ATT&CK project declares the attack technique as T1110.001.

A private exploit has been developed by Skelet4r in Python. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 122 days. During that time the estimated underground price was around . Although an exploit is not currently publicly available, a proof-of-concept exploit has been developed by Skelet4r and jTag Labs to confirm the existence of this vulnerability within the Caterease application. This exploit was created for internal use only and is not being released publicly. To exploit this vulnerability, an attacker can use a scripting language like Python to automate the process of entering passwords into the password field and checking if the 'OK' button becomes active. This allows the attacker to repeatedly attempt different passwords without any restrictions or rate limiting caused by the server, as the password attempts are never sent to the server and the attacker can validate their legitimacy on the front end of the application.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Hospitality Software

Vendor

• Horizon Business Services

Name

• Caterease

Version

• 24.0.1.2405

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #383228: Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 CWE-307: Improper Restriction of Excessive Authentication Attemp (by jTag Labs)

Once again VulDB remains the best source for vulnerability data.

Discussion