PT-2022-10038 · Beyondtrust · Beyondtrust Secure Remote Access Base

Ahmed Aboul-Ela + 1 · Published 2022-01-05 · Updated 2022-02-07 · CVE-2021-31589

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BeyondTrust Secure Remote Access Base Software versions prior to 6.0.2

Description A cross-site scripting (XSS) issue allows the injection of specially-crafted web requests without proper sanitization. This occurs when an unauthenticated, crafted web request is sent to the server, potentially allowing an attacker to achieve full admin access to the appliance by tricking the administrator into creating a new admin account through an XSS/CSRF attack involving a crafted request to the "/appliance/users?action=edit" endpoint.

Recommendations For BeyondTrust Secure Remote Access Base Software versions prior to 6.0.2, update to a version newer than 6.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/appliance/users?action=edit" endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-31589

Affected Products

Beyondtrust Secure Remote Access Base

References · 7

• 🔥 https://github.com/karthi-the-hacker/CVE-2021-31589 · Exploit
• 🔥 http://packetstormsecurity.com/files/165408/BeyondTrust-Remote-Support-6.0-Cross-Site-Scripting.html · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2022010013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31589 · Security Note
• https://beyondtrust.com/docs/release-notes/index.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31589 · Vendor Advisory
• https://t.me/cibsecurity/34975 · Telegram Post