PT-2023-30917 · Warpgate · Warpgate

Cmsmith1977 · Published 2023-11-24 · Updated 2023-11-30 · CVE-2023-48712

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.9.0

Description Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions, there is a privilege escalation issue through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password, they can subsequently enter a valid non-admin username and password and will be logged in as the admin user.

Recommendations For versions prior to 0.9.0, upgrade to version 0.9.0 or later to resolve the issue. As a temporary workaround, consider configuring multi-factor authentication to minimize the risk of exploitation. Restrict access to the login screen for non-admin users until the upgrade is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-48712

GHSA-C94J-VQR5-3MXR

Affected Products

Warpgate

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48712.json · Exploit
• https://github.com/warp-tech/warpgate/commit/e3b26b2699257b9482dce2e9157bd9b5e05d9c76 · Patch
• https://github.com/warp-tech/warpgate/security/advisories/GHSA-c94j-vqr5-3mxr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48712 · Security Note
• https://t.me/cvenotify/61238 · Telegram Post