Improper Authentication in Burden

61.9k
3
8
12
3
More
3
5

Advisory ID:	HTB23192
Product:	Burden
Vendor:	Josh Fradley
Vulnerable Versions:	1.8 and probably prior
Tested Version:	1.8
Advisory Publication:	December 18, 2013 [without technical details]
Vendor Notification:	December 18, 2013
Vendor Fix:	December 18, 2013
Public Disclosure:	January 8, 2014
Latest Update:	January 6, 2014
Vulnerability Type:	Improper Authentication [CWE-287]
CVE Reference:	CVE-2013-7137
Risk Level:	High

CVSSv2 Base Score:	7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in application authentication mechanism in Burden, which can be exploited by remote non-authenticated attacker to gain administrative access to the vulnerable application. 1) Improper Authentication in Burden: CVE-2013-7137 The vulnerability exists due to insufficient authentication when handling "burden_user_rememberme" cookie parameter. A remote unauthenticated user can set "burden_user_rememberme" cookie to "1" and gain administrative access to the application. The exploitation example below shows HTTP GET request that grants administrative privileges to the user: GET /login.php HTTP/1.1 Cookie: burden_user_rememberme=1; The cookie can be also changed using a browser plugin such as Firebug for FireFox.
How to Detect Improper Authentication Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
Update to Burden 1.8.1 More Information: https://github.com/joshf/Burden/releases/tag/1.8.1

References:
[1] High-Tech Bridge Advisory HTB23192 - https://www.immuniweb.com/advisory/HTB23192 - Improper Authentication in Burden. [2] Burden - https://github.com/joshf - Burden is a full featured task management app written in PHP. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.

Previous Security Advisories with CWE-287:

HTB23117: Multiple vulnerabilities in AContent

HTB23101: Multiple vulnerabilities in PBBoard

61.9k
3
8
12
3
More
3
5

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.