Authentication Bypass in sso-master via POST Request

Executive Summary

This vulnerability is an authentication bypass flaw in the CAS login system of sso-master v1.0.0. It allows attackers to gain unauthorized administrative access without a password by sending a crafted POST request to /cas/login with specific parameters. The system checks for hardcoded values 'username=admin' and 'system=sso' and grants access unconditionally, bypassing all password validation and security measures.

Useful 0 Not Useful 0

Detection Guidance

Check for POST requests to /cas/login with parameters username=admin and system=sso. Monitor for successful authentication without password input. Inspect logs for repeated failed login attempts followed by admin access.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to log in as an administrator without a password, gaining full control over the application. This could lead to unauthorized data access, modification, or deletion, system compromise, and potential lateral movement within a network. The attack does not require prior knowledge or valid credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR's data protection principles or HIPAA's access controls. Organizations using this software may face legal penalties, reputational damage, and loss of trust due to non-compliance with regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update sso-master to a patched version. Remove hardcoded authentication bypass in UsernamePasswordSystemAuthenticationHandler. Disable default admin credentials and enforce strong password policies.

Useful 0 Not Useful 0