Authentication Bypass in GBIF IPT Before First Reboot

Executive Summary

This vulnerability is an authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4. During initial setup, the system leaves the setup functionality exposed until the first reboot. This allows remote authenticated attackers to gain administrative control by accessing the /setupInstallationComplete.do endpoint, which provides an administrative JSESSIONID cookie without proper authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if the /setupInstallationComplete.do endpoint is accessible without authentication before the first reboot. Use curl to test the endpoint: curl -v http://<target-IP>/setupInstallationComplete.do. If it returns an administrative JSESSIONID cookie, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrative access to the IPT system, potentially allowing them to modify configurations, access sensitive data, or disrupt services. Exploitation requires knowledge of the specific endpoint but no additional tools or credentials. The impact is high but exploitability is low since the vulnerability only exists before a reboot.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Integrated Publishing Toolkit to version 3.3.4 or later to resolve the vulnerability. If immediate updating is not possible, reboot the server to temporarily mitigate the issue until the update can be applied.

Useful 0 Not Useful 0