Authenticated Privilege Escalation via Host Header Handling in BunkerWeb UI and API

Vulnerability Overview Vulnerability Name: Authenticated privilege escalation via Host header handling in BunkerWeb UI and API Vulnerability Type: Privilege Escalation Severity: Medium (6.1 / 10) CVSS Base Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: Low - User Interaction: None Vulnerability System Impact Metrics: - Confidentiality: Low - Integrity: High - Availability: High Vulnerability Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Impact Scope Affected Software: BunkerWeb, BunkerWeb PRO Affected Versions: - BunkerWeb: < 1.6.12 - BunkerWeb PRO: < 0.57 Impact Description: - An authenticated privilege escalation vulnerability exists when the BunkerWeb UI and API are directly exposed and not protected by BunkerWeb itself. - A low-privileged authenticated user may be able to inject a crafted Host header, affecting the generation of Biscuit authentication tokens. - Under affected deployment conditions, this allows an attacker to gain elevated privileges, including administrative access. - The vulnerability is only exploitable if the BunkerWeb UI and/or API can be accessed without BunkerWeb acting as a front-end (or any other reverse proxy configured with virtual hosts/virtual paths). - Deployments where BunkerWeb properly secures access to the UI and API are not impacted by this attack vector. - This issue requires the attacker to already possess a valid low-privileged user account. It is currently known to not be exploitable by unauthenticated attackers. Remediation Patch: - This issue has been fixed in BunkerWeb version 1.6.12. - Users running affected versions should upgrade to version 1.6.12 or later. Temporary Mitigation: - Users unable to upgrade immediately should ensure that the BunkerWeb UI and API are not directly exposed to untrusted networks. - As a temporary mitigation, restrict the UI and API to trusted networks only and ensure BunkerWeb is placed in front to control incoming requests and headers. - After applying the patch, administrators may also consider invalidating existing sessions or low-privileged user authentication tokens if they suspect the vulnerable configuration has been exposed.

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated Privilege Escalation via Host Header Handling in BunkerWeb UI and API

More from this source