ApiSec: The week of Dec'20 2021
Podman API authentication vulnerability
A flaw was found in podman. The?podman machine?function (used to create and manage Podman virtual machine containing a Podman process) spawns a?gvproxy?process on the host system. The?gvproxy?API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host’s firewall, an attacker can potentially use the?gvproxy?API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host’s services by forwarding all ports to the VM. Source: https://github.com/containers/podman/releases/tag/v3.4.3
SonicWall SMA100 API authentication vulnerability
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability affected 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions. Source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0030
领英推荐
mySCADA myPRO API Remote Code Injection
mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter. Source: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-01
Dalmark Systems Systeam API authentication bypass by temporary JWT token
Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application counterparts. A broken access control vulnerability has been found while using a temporary generated token in order to consume api resources. The vulnerability allows an unauthenticated attacker to use an api endpoint to generate a temporary JWT token that is designed to reference the correct tenant prior to authentication, to request system configuration parameters using direct api requests. The correct exploitation of this vulnerability causes sensitive information exposure. In case the tenant has an smtp credential set, the full credential information is disclosed. Source: https://www.systeam.com.br/cve/broken-access-control-en.txt