PT-2018-18427 · Datalust · Datalust Seq

Daniel Chactoura · Published 2018-03-14 · Updated 2019-02-28 · CVE-2018-8096

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Datalust Seq versions prior to 4.2.605

Description: The issue allows for authentication bypass, enabling an attacker to obtain admin access. This can be achieved by sending a PUT request to the "api/settings/setting-isauthenticationenabled" endpoint with the parameter Name set to "isauthenticationenabled" and Value set to false.

Recommendations: For versions prior to 4.2.605, update to version 4.2.605 or later to resolve the issue. As a temporary workaround, consider restricting access to the "api/settings/setting-isauthenticationenabled" endpoint to minimize the risk of exploitation. Avoid using the parameter Name with the value "isauthenticationenabled" and Value set to false in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-8096

Affected Products

Datalust Seq

References · 5

• 🔥 https://exploit-db.com/exploits/45136 · Exploit
• 🔥 https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732 · Exploit
• https://github.com/datalust/seq-tickets/issues/675 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-8096 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8096 · Vendor Advisory