PT-2022-17340 · Unknown · Freetakserver

Securitybits-Io · Published 2022-03-10 · Updated 2022-03-22 · CVE-2022-25510

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeTAKServer version 1.9.8

Description The issue concerns a hardcoded Flask secret key in FreeTAKServer, which allows attackers to create crafted cookies. This can lead to bypassing authentication or escalating privileges.

Recommendations For FreeTAKServer version 1.9.8, consider regenerating the Flask secret key to prevent attackers from creating crafted cookies. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-25510

GHSA-F897-875P-23X7

PYSEC-2022-43135

Affected Products

Freetakserver

References · 9

• 🔥 https://github.com/FreeTAKTeam/FreeTakServer/issues/292 · Exploit
• https://osv.dev/vulnerability/CVE-2022-25510 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f897-875p-23x7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25510 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-43135 · Vendor Advisory
• https://github.com/FreeTAKTeam/FreeTakServer · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/freetakserver/PYSEC-2022-43135.yaml · Note
• https://t.me/cibsecurity/38758 · Telegram Post
• https://t.me/cvenotify/28075 · Telegram Post