Improper Authorization in Mysterium Node Configuration

Compliance Impact

The vulnerability allows unauthenticated attackers to arbitrarily overwrite the node's configuration and achieve a full node takeover. This improper authorization and potential full control over the node could lead to unauthorized access or manipulation of data handled by the node.

Such unauthorized access and control could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and confidentiality. A full node takeover could result in data breaches or unauthorized data processing, thereby violating these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an improper authorization issue in the /tequilapi/config/user endpoint of Mysterium Node versions before v1.36.0. It allows unauthenticated attackers to send a specially crafted POST request to arbitrarily overwrite the node's configuration.

By exploiting this, an attacker can achieve a full takeover of the node.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe because it allows an unauthenticated attacker to fully take over the affected Mysterium Node.

• Arbitrary overwriting of the node's configuration.
• Complete control over the node by the attacker.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Mysterium Node is running a version prior to v1.36.0 and if the /tequilapi/config/user endpoint is accessible without authentication.

A practical detection method is to send a crafted POST request with a JSON payload to the /tequilapi/config/user endpoint and observe if the node's configuration can be overwritten without authentication.

Example command using curl to test the vulnerability:

• curl -X POST http://<node-ip>:<port>/tequilapi/config/user -d '{"someConfigKey":"someValue"}' -H "Content-Type: application/json"

If the request succeeds without authentication and the configuration changes, the node is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Mysterium Node software to version 1.36.0 or later, where the vulnerability has been fixed by securing the /tequilapi/config/user endpoint.

Until the upgrade can be performed, restrict network access to the /tequilapi/config/user endpoint to trusted users only, for example by firewall rules or network segmentation.

Additionally, monitor and audit access logs for any unauthorized POST requests to the vulnerable endpoint.

Useful 0 Not Useful 0