PT-2022-1751 · Unknown · October Cms

Nikita Khaetsky + 1 · Published 2022-02-20 · Updated 2022-03-07 · CVE-2022-23655

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to build 474 OctoberCMS versions prior to v1.1.10 OctoberCMS version 1.0

Description The issue is related to the lack of validation of gateway server signatures in OctoberCMS, allowing non-authoritative gateway servers to be used for exfiltrating user private keys. This can lead to unauthorized access to protected information. The vulnerability affects authors of plugins and themes listed on the October CMS marketplace, where an end-user may inadvertently expose authors to potential financial loss by entering their private license key into a compromised server. A project fork of October CMS v1.0 has been disclosed to be using a compromised gateway to access the October CMS marketplace service, capturing personal and business information of users and authors, including private source code files.

Recommendations For OctoberCMS versions prior to build 474, upgrade to build 474 or apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) manually. For OctoberCMS versions prior to v1.1.10, upgrade to v1.1.10 or apply the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) manually. For OctoberCMS version 1.0, consider upgrading to a newer version or applying the patch (e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a) manually as a temporary workaround. Do not share your license key with anyone except October CMS. Check to make sure that your gateway update server has not been modified. Be aware of phishing websites, including other platforms that use the same appearance. For authors, you may contact October CMS for help requesting the removal of affected plugins. Before providing plugin support, verify that the user holds a legitimate copy of the plugin.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2022-01033

CVE-2022-23655

GHSA-53M6-44RC-H2Q5

Affected Products

October Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23655.json · Exploit
• https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a · Patch
• https://github.com/octobercms/october/security/advisories/GHSA-53m6-44rc-h2q5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23655 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23655 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01033 · Security Note
• https://osv.dev/vulnerability/GHSA-53m6-44rc-h2q5 · Vendor Advisory
• https://github.com/octobercms/october · Note
• https://t.me/cvenotify/27254 · Telegram Post
• https://t.me/cibsecurity/37974 · Telegram Post