cbcvebase.
CVE-2016-6603
published 2017-01-23

CVE-2016-6603: ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.

PriorityP184critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
86.93%
99.7th percentile
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.

Affected

1 ranges
VendorProductVersion rangeFixed in
zohocorpwebnms_framework——

Detection & IOCsextracted from sources · hover to see the quote

url/servlets/GetChallengeServlet↗
otherUserName: root↗
  • →Detect unauthenticated requests to /servlets/GetChallengeServlet that include a 'UserName' HTTP header — this is the exploit trigger for CVE-2016-6603 authentication bypass/impersonation. ↗
  • →Alert on any HTTP request containing the 'UserName' header targeting WebNMS servlets, as this header is not a standard HTTP header and is the sole mechanism for user impersonation in this vulnerability. ↗
  • →Monitor for issuance of a SessionId cookie (JSESSIONID) in response to unauthenticated GET requests to /servlets/GetChallengeServlet, which indicates successful exploitation. ↗
  • ·The vulnerability affects WebNMS Framework Server 5.2 and 5.2 SP1; no fixed version was confirmed available at time of disclosure as the vendor did not respond to contact attempts. ↗
  • ·The impersonation attack requires no prior credentials and works against any username, including the superuser 'root', enabling full administrative access. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.