Lepton CMS 2.2.2 Bruteforce Protection privileges management

Summaryinfo

A vulnerability was found in Lepton CMS 2.2.2. It has been declared as problematic. Affected is an unknown function of the component Bruteforce protection. The manipulation results in privileges management. The attack may be performed from remote. In addition, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Lepton CMS 2.2.2 (Content Management System). Affected is some unknown processing of the component Bruteforce Protection. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 11/17/2016 by Tim Coen with Curesec Research Team as Lepton 2.2.2: CSRF, Open Redirect, Insecure Bruteforce Protection & Password Handling as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release was coordinated in cooperation with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1068. The reason for this vulnerability is this part of code:

if($_SESSION['ATTEMPS'] > $this->max_attemps) { $this->warn(); }

A public exploit has been developed by Tim Coen and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 169 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.3.0 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

See VDB-93706, VDB-93707, VDB-93709 and VDB-93710 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Lepton

Name

• CMS

Version

• 2.2.2

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion