CVE-2020-27747 PoC — Click Studios Passwordstate 安全漏洞

Source

Associated Vulnerability

Description

Possible Account Takeover | Brute Force Ability

Readme

# CVE-2020-27747
Possible Account Takeover | Brute Force Ability

[Suggested description]
An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).
If the user of the system has assigned himself a PIN code for entering
from a mobile device using the built-in generator (4 digits), a remote
attacker has the opportunity to conduct a brute force attack on this
PIN code.
------------------------------------------
[Additional Information]
A letter was sent to the vendor about the vulnerability.
------------------------------------------
[VulnerabilityType Other]
CWE-307: Improper Restriction of Excessive Authentication Attempts
------------------------------------------
[Vendor of Product]
Click Studios (https://www.clickstudios.com.au/)
------------------------------------------
[Affected Product Code Base]
Affected version: Passwordstate 8.9 (Build 8973). There are no fixed versions
------------------------------------------
[Affected Component]
Mobile login page
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
If the user of the system has assigned himself a PIN code for entering
from a mobile device using the built-in generator (4 digits), a remote
attacker has the opportunity to conduct a brute force attack on this
PIN code.
------------------------------------------
[Discoverer]
Dmitry Kuramin (Jet Infosystems, jet.su)
------------------------------------------
[Reference]
https://jet.su

File Snapshot

 [4.0K]  /data/pocs/b9a254acb05dce4ebd9220db662158679ac8cb99
├── [132K]  account_takeover_result.jpg
├── [ 64K]  pin_by_def_gen_only_num4.jpg
└── [1.5K]  README.md

0 directories, 3 files

Remarks