Alerta < 8.1.0 - Authentication Bypass

ID: CVE-2020-26214

Severity: critical

Author: CasperGN,daffainfo

Tags: cve,cve2020,alerta,auth-bypass,alerta_project

Description

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests.

YAML Source

id: CVE-2020-26214

info:
  name: Alerta < 8.1.0 - Authentication Bypass
  author: CasperGN,daffainfo
  severity: critical
  description: Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to Alerta.
  remediation: |
    Upgrade Alerta to version 8.1.0 or later to mitigate this vulnerability.
  reference:
    - https://github.com/advisories/GHSA-5hmm-x8q8-w5jh
    - https://tools.ietf.org/html/rfc4513#section-5.1.2
    - https://pypi.org/project/alerta-server/8.1.0/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26214
    - https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-26214
    cwe-id: CWE-287
    epss-score: 0.01324
    epss-percentile: 0.85971
    cpe: cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: alerta_project
    product: alerta
  tags: cve,cve2020,alerta,auth-bypass,alerta_project

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/config'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, '< 8.1.0')

      - type: word
        part: body
        words:
          - '"alarm_model"'
          - '"actions"'
          - '"severity"'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '"name": "Alerta ([0-9.]+)"'
        internal: true

      - type: regex
        group: 1
        regex:
          - '"name": "Alerta ([0-9.]+)"'
# digest: 4a0a00473045022100cddc6be72e6b507473bdb366e7678dcd455d2743dc5029794f1491c6cee73d45022017391e70cf33e9e51957ed1aff65fc9980651746c0b77775538193a7770eca87:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-26214.yaml"

View on Github