SB2017012502 - Administrative password reset in Pagekit CMS

Description

This security bulletin contains information about 1 vulnerability.

1) Administrative password reset (CVE-ID: CVE-2017-5594)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

The vulnerability allows a remote attacker to gain administrative access to vulnerable website.

The vulnerability exists due to incorrect validation of user-supplied data during password reset process, when the debug toolbar is enabled. A remote attacker can send a specially crafted HTTP request and reset administrator’s password.

Successful exploitation of the vulnerability may allow an attacker to gain full access to vulnerable website.

Remediation

Install update from vendor's website.

References

• https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b
• https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf
• https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt