PT-2020-8929 · Anixis · Anixis Password Reset Client

Jason Juntunen + 1 · Published 2020-09-29 · Updated 2020-10-20 · CVE-2018-5354

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ANIXIS Password Reset Client versions prior to 3.22

Description The issue allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the issue can be exploited via RDP.

Recommendations For versions prior to 3.22, update to version 3.22 or later to resolve the issue. As a temporary workaround, consider configuring the client to use a secure connection protocol instead of HTTP and enforcing Network Level Authentication to minimize the risk of exploitation. Restrict access to RDP connections when possible to further reduce the risk.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2018-5354

Affected Products

Anixis Password Reset Client

References · 4

• 🔥 https://github.com/missing0x00/CVE-2018-5354 · Exploit
• http://anixis.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5354 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5354 · Vendor Advisory