PT-2021-17335 · Shinobi · Shinobi

Ins0 · Published 2021-02-22 · Updated 2021-02-26 · CVE-2021-27228

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Shinobi through ocean version 1

Description: An issue was discovered in the lib/auth.js file, where Incorrect Access Control allows attackers to bypass API key validation. By utilizing JavaScript Proto Method names, such as constructor or hasOwnProperty, an attacker can trick the system into believing a supplied API key is valid, thus gaining complete access to User, Admin, and Super API functions. This can be achieved through API endpoints like "/super/constructor/accounts/list".

Recommendations: For Shinobi through ocean version 1, consider restricting access to the lib/auth.js file and limiting the use of JavaScript Proto Method names to prevent exploitation until a proper fix is implemented. As a temporary workaround, restrict access to sensitive API endpoints, such as "/super/constructor/accounts/list", to minimize the risk of unauthorized access.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-27228

Affected Products

Shinobi

References · 5

• https://osv.dev/vulnerability/CVE-2021-27228 · Vendor Advisory
• https://gitlab.com/Shinobi-Systems/Shinobi/-/tags · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-27228 · Security Note
• https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/286 · Patch
• https://shinobi.video · Note