PT-2020-18318 · Opencast · Opencast

Lukas Kalbertodt · Published 2020-01-30 · Updated 2020-02-05 · CVE-2020-5222

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1

Description The issue allows an attacker to gain access to all servers that use the same credentials without needing the credentials, by exploiting a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that if an attacker gets access to a remember-me token for one server, they can use it to access all other servers that allow log-in using the same credentials. The problem is caused by a hard-coded system key in the etc/security/mh default org.xml file, which is used by all Opencast systems.

Recommendations For Opencast versions prior to 7.6, update to Opencast 7.6 to fix the issue. For Opencast versions prior to 8.1, update to Opencast 8.1 to fix the issue. As a temporary workaround for older versions, set a custom key for each server in the etc/security/mh default org.xml file, for example:

<sec:remember-me key="CUSTOM RANDOM KEY" user-service-ref="userDetailsService" />

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-5222

GHSA-MH8G-HPRG-8363

Affected Products

Opencast

References · 6

• https://github.com/opencast/opencast/commit/1a7172c95af8d542a77ae5b153e4c834dd4788a6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5222 · Security Note
• https://osv.dev/vulnerability/GHSA-mh8g-hprg-8363 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5222 · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-mh8g-hprg-8363 · Note
• https://t.me/cvenotify/681 · Telegram Post