PT-2021-23089 · Unknown · Wire-Server
Sebastian-Wire
·
Published
2021-10-04
·
Updated
2021-10-12
·
CVE-2021-41100
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Wire-server versions prior to 2021-08-16
Description
The issue allows an attacker to trigger an email address change of a user with only the short-lived session token in the
Authorization header, constituting a privilege escalation attack. This can result in an account takeover by the attacker, as they can change the password after setting the email address to one they control. The short-lived tokens are used more often and in the shape of an HTTP header, increasing the risk of exposure to an attacker. If you are running an on-prem instance and provision all users with SCIM, you are not affected by this issue. SAML single-sign-on is unaffected by this issue. The vulnerable endpoint is /self/email, which only accepts PUT and DELETE requests.Recommendations
For versions prior to 2021-08-16, update to version 2021-08-16 or later, which provides a new endpoint that requires both the long-lived client cookie and
Authorization header.
As a temporary workaround for on-prem instances that cannot be updated and have at least some users invited or provisioned via SAML SSO, block the /self/email endpoint on nginz or in any other proxies or firewalls.Fix
Improper Authorization
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wire-Server