CVE-2016-10532
published 2018-05-31CVE-2016-10532: console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any…
PriorityP261critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.37%
81.7th percentile
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| console-io_project | console-io | <= 2.2.13 | — |
| console-io_project | console-io | >= 0 < 2.3.0 | 2.3.0 |
| hackerone | console-io_node_module | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Authentication Bypass in console-io
ghsa·2019-02-18
CVE-2016-10532 [CRITICAL] CWE-287 Authentication Bypass in console-io
Authentication Bypass in console-io
Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.
## Recommendation
Update to version 2.3.0 or later.
OSV
Authentication Bypass in console-io
osv·2019-02-18
CVE-2016-10532 [CRITICAL] Authentication Bypass in console-io
Authentication Bypass in console-io
Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.
## Recommendation
Update to version 2.3.0 or later.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-05-31
Published