PT-2023-25650 · Prolion · Prolion Cryptospike

Published 2023-12-11 · Updated 2023-12-14 · CVE-2023-36647

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description A hard-coded cryptographic private key used to sign JWT authentication tokens allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider regenerating and updating the cryptographic private key used for signing JWT authentication tokens to prevent impersonation attacks. As a temporary workaround, restrict access to the REST API endpoints and web management interfaces to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-36647

Affected Products

Prolion Cryptospike

References · 7

• 🔥 https://cvcn.gov.it/cvcn/cve/CVE-2023-36647 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36647 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36647 · Vendor Advisory
• https://t.me/cvenotify/63257 · Telegram Post
• https://twitter.com/CVEnew/status/1734379219440857372 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734491512170246218 · Twitter Post
• https://t.me/cvenotify/63603 · Telegram Post