Executive Summary

This vulnerability in Mangati NovoSGA up to version 2.2.12 allows attackers to create user accounts with weak passwords due to insufficient enforcement of strong password requirements in the User Creation Page (/novosga.users/new). Specifically, manipulation of the password fields ('Senha' and 'Confirmação da senha') enables setting weak and predictable passwords like '123456'. This flaw can be exploited remotely without authentication, although the attack is considered complex and difficult. The vulnerability increases the risk of unauthorized access and compromises the security of the platform. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to several security impacts including increased risk of brute-force and credential stuffing attacks, potential unauthorized access to user or administrative accounts, possible privilege escalation through compromised accounts, and overall degradation of the application's security posture. Since weak passwords can be used, attackers may gain access to sensitive information or control over the system. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for the creation of user accounts with weak passwords, especially those matching common weak passwords like "123456". Since the vulnerability affects the /novosga.users/new endpoint, you can inspect web server logs or use network monitoring tools to detect POST requests to this endpoint that include weak password values in the 'Senha' or 'Confirmação da senha' fields. Commands to check logs might include searching for such requests with tools like grep, for example: grep -i 'POST /novosga.users/new' /var/log/apache2/access.log | grep -E '123456|password|qwerty'. Additionally, scanning for accounts with weak passwords in the system database or user management interface can help detect exploitation. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing strong password policies requiring minimum length and a mix of uppercase, lowercase, digits, and special characters; blocking commonly known weak passwords using blocklists (e.g., "123456", "password", "qwerty"); encouraging or enforcing multi-factor authentication (MFA); and implementing rate-limiting or account lockout mechanisms to hinder brute-force attempts. Since no patches or vendor fixes are available, consider applying external controls or using alternative products to reduce risk. [1, 2]

Useful 0 Not Useful 0