PT-2014-3406 · Tomato · Tomato

Published 2014-05-16 · Updated 2020-08-31 · CVE-2013-7379

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tomato versions prior to 0.0.6

Description The admin API in the tomato module does not properly check the access key when it is set to a string, allowing remote attackers to bypass authentication via a string in the access-key header that partially matches config.master.api.access key. This vulnerability enables an attacker to guess the password for the admin service in less than 200 requests, regardless of the password's complexity. The issue arises from the tomato API's verification of the access key by checking if the server access key incorporates the user-provided value at any location.

Recommendations For versions prior to 0.0.6, update to version 0.0.6 or later. As a temporary workaround, consider restricting access to the admin service or modifying the access key verification to prevent partial matches. Avoid using short or simple access key values until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-7379

GHSA-9VXC-G2JX-QJ3P

Affected Products

Tomato

References · 8

• 🔥❌ https://github.com/leizongmin/tomato/commit/9e427d524e04a905312a3294c85e939ed7d57b8c · Exploit, Deleted
• 🔥 https://nodesecurity.io/advisories/Tomato_API_Admin_Auth_Weakness · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-7379 · Security Note
• https://osv.dev/vulnerability/GHSA-9vxc-g2jx-qj3p · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/05/15/2 · Note
• http://openwall.com/lists/oss-security/2014/05/13/1 · Note
• ❌ https://github.com/leizongmin/tomato · Note, Deleted
• https://npmjs.com/advisories/38 · Note