PT-2021-14426 · Ratcf · Ratcf

0Xadap · Published 2021-03-08 · Updated 2021-03-12 · CVE-2021-21329

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RATCF versions prior to the version including commit cebb67b

Description RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF, users with multi-factor authentication enabled are able to log in without a valid token.

Recommendations For versions prior to the version including commit cebb67b, update to a version that includes the fix commit cebb67b to resolve the issue. As a temporary workaround, consider disabling multi-factor authentication until the patch is applied. Restrict access to the login functionality to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-21329

GHSA-FW57-F7MQ-9Q85

Affected Products

Ratcf

References · 6

• https://github.com/ractf/core/commit/c57a4d186bfc586ad3edfe4dcba9f11efbf22f09#diff-60c444c47c061306f2dff5bf97c07810f40f949a8e94ecbb609b6b29364c8642R130-R152 · Patch
• https://github.com/ractf/core/commit/cebb67bd16a8296121201805332365ffccb29638 · Patch
• https://github.com/ractf/core/security/advisories/GHSA-fw57-f7mq-9q85 · Patch
• https://osv.dev/vulnerability/CVE-2021-21329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21329 · Security Note
• https://t.me/cvenotify/11009 · Telegram Post