Authentication Bypass in Krayin CRM Installer

Executive Summary

Krayin CRM 2.2.4 has a missing authentication vulnerability in its installer middleware. This flaw allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header. The vulnerability bypasses the CanInstall middleware redirect check, enabling attackers to supply arbitrary name, email, and password values to the admin-config-setup endpoint. This results in an unauthenticated updateOrInsert operation targeting the hardcoded administrator user ID, granting full administrative access to all CRM data.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized POST requests to the /admin-config-setup endpoint with the X-Requested-With: XMLHttpRequest header. Monitor logs for attempts to modify the administrator account without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full administrative access to your Krayin CRM system without authentication. They can take complete control of the CRM, access all stored data, modify or delete records, and potentially steal sensitive information. The impact includes unauthorized data exposure, system compromise, and loss of data integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA. Unauthorized administrative access may lead to data breaches, exposing personal or protected health information. This could result in legal penalties, fines, and reputational damage due to non-compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Krayin CRM to a patched version if available. If not, restrict access to the /admin-config-setup endpoint via firewall rules or web server configuration. Review and audit administrator accounts for unauthorized changes.

Useful 0 Not Useful 0