PT-2021-21925 · Unknown · Huntflow Enterprise

Andrey Lomtev · Published 2021-10-14 · Updated 2021-10-20 · CVE-2021-37933

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Huntflow Enterprise versions prior to 3.10.6

Description: The issue is related to an LDAP injection vulnerability in the /account/login endpoint. It allows an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication due to insufficient server-side validation of the email parameter. An attacker could exploit this by sending login attempts with a valid password and a wildcard character in the email parameter.

Recommendations: For versions prior to 3.10.6, update to version 3.10.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the /account/login endpoint or validating the email parameter on the client-side to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-37933

Affected Products

Huntflow Enterprise

References · 4

• 🔥 https://gist.github.com/andrey-lomtev/cbf12bc8d8763996cf8d6d1641a0b049 · Exploit
• https://osv.dev/vulnerability/CVE-2021-37933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37933 · Security Note
• https://t.me/cibsecurity/30579 · Telegram Post