Insecure cryptographic storage in Defender - #VU20850
Published: September 4, 2019
Vulnerability identifier: #VU20850
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: One Identity
Affected software:
Defender
Defender
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the software stores token seeds, PAP secrets, and user passwords in Active Directory attributes. Defender passwords are hashed using MD5 in conjunction with a static key for obfuscation, which allows a remote authenticated user to read the computed hash from the defender-user TokenData attribute in Active Directory and then use it in an offline brute force attack.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.