FOGProject Unauthenticated RCE Erases AES Credentials (GHSA-95pr-mcrf-x2zg)

Vulnerability Overview Vulnerability ID: GHSA-95pr-mcrf-x2zg Vulnerability Title: 093 Unauthenticated and allow remote destruction of host encryption keys and power schedules Vulnerability Description: The and methods in FOGProject can be remotely exploited via unauthenticated HTTP GET requests. This results in the erasure of host AES encryption credentials and the deletion of all power management scheduled tasks, without requiring authentication, session cookies, or CSRF tokens. Impact Scope Affected Versions: = 1.5.10.1832, >= 1.6.0-beta.2313 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: Low Remediation Patch Versions: >= 1.5.10.1832, >= 1.6.0-beta.2313 POC Code Impact Any unauthenticated client that has access to the FOG web management interface can: Erase AES encryption credentials for any host (by ID) or all hosts (by group ID), breaking encrypted FOG client-server communication and forcing re-registration. This creates opportunities for man-in-the-middle attacks and client re-registration. Delete all power management scheduled tasks for any group, permanently disrupting shutdown/wake/LAN schedules. Enumerate all hosts and groups by brute-forcing sequential integer IDs starting from 1. This affects any FOG deployment where the management web interface is accessible to untrusted clients. Standard installations create paths under without IP-based restrictions or IP/Access protection by default. Affected Versions From commit (September 26, 2016) to the current HEAD, including the latest stable version 1.5.10.

Goal Reached Thanks to every supporter — we hit 100%!

FOGProject Unauthenticated RCE Erases AES Credentials (GHSA-95pr-mcrf-x2zg)

More from this source