Authentication Bypass in XWEB EVO

Executive Summary

XWEB EVO 5.6.2 through 5.8.8 has an authentication bypass flaw in the users.lua update_password action. Unauthenticated attackers can reset passwords for accounts marked must-reset-at-next-login by exploiting missing session validation. This allows immediate authenticated access, especially for newly onboarded operator accounts.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized password resets in the users.lua update_password action logs. Inspect network traffic for POST requests to /users/update_password without valid session tokens. Verify if any accounts flagged as must-reset-at-next-login have had their passwords changed without authentication.

Useful 0 Not Useful 0

Impact Analysis

Attackers can gain full authenticated access to the system by resetting passwords for operator accounts. This provides unauthorized control over the system, potentially leading to data breaches, system manipulation, or further network compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for access control and authentication, such as GDPR's data protection principles or HIPAA's security rules. Unauthorized access risks exposing sensitive data, leading to regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade XWEB EVO to a version beyond 5.8.8 if available. If not, restrict network access to the system until patched. Monitor for unauthorized password changes and disable must-reset-at-next-login accounts until the issue is resolved.

Useful 0 Not Useful 0