20 Dec Security Advisory – SOS-10-004 -Elcom Technology’s CommunityManager.NET Auth Bypass Vulnerability
Release Date: 20-Dec-2010
Last Update: –
Vendor Notification Date: 20-Jan-2010
Product: Elcom Technology’s CommunityManager.NET
Platform: IIS with ASP.NET
Affected versions: CommunityManager.NET v6.7 verified and possibly others
Severity Rating: High
Impact: Application “System” user access
Attack Vector: Remote without authentication
Solution Status: Vendor patch
CVE reference: Not yet assigned
The web application uses cookie parameters passed via HTTP requests to identify which user is logged in. Authentication routines can be bypassed by simply appending the below POC string to a cookie which already contains a valid ASP.NET session ID. The value given to the various cookie parameters indicates the specific user ID for the application user the attacker wishes to impersonate.
Please refer to the PDF version of this advisory for proof of concept code examples.
Sense of Security has been advised that Elcom Technology has patched all versions of CommunityManager.NET and notified all clients.
Sense of Security Labs.