PT-2021-23948 · Opencast · Opencast

Lkiesow · Published 2021-12-14 · Updated 2021-12-20 · CVE-2021-43807

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Opencast versions prior to 9.10

Description: Opencast is an Open Source Lecture Capture & Video Management for Education. The issue allows HTTP method spoofing via URL parameter, enabling attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions on these types of requests and aids in cross-site request forgery (CSRF) attacks. Attackers can craft links or forms that change the server state. For example, a GET request can create a new user. If an admin is logged in and accidentally clicks a malicious link, a user will silently be created.

Recommendations: To resolve the issue, update to Opencast 9.10 or 10.0. As a temporary workaround, consider setting the SameSite=Strict attribute for your cookies, if this is a viable option for your integrations.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2021-43807

GHSA-J4MM-7PJ3-JF7V

Affected Products

Opencast

References · 9

• 🔥 https://github.com/opencast/opencast/security/advisories/GHSA-j4mm-7pj3-jf7v · Exploit
• https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8 · Patch
• https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444 · Patch
• https://osv.dev/vulnerability/CVE-2021-43807 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j4mm-7pj3-jf7v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43807 · Security Note
• https://github.com/opencast/opencast · Note
• https://t.me/cibsecurity/33960 · Telegram Post
• https://t.me/cvenotify/24639 · Telegram Post