CVE-2017-16935

published 2017-11-24

CVE-2017-16935: Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions…

Priority P2 70 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ametys	ametys	< 4.0.3	4.0.3

Detection & IOCs extracted from sources · hover to see the quote

path /plugins/core-ui/servercomm/messages.xml↗

path /plugins/core-ui/servercomm/messages.xml↗

url users/search.json↗

command editUser↗

command org.ametys.plugins.core.user.UserDAO↗

• → Flag unauthenticated POST requests to /plugins/core-ui/servercomm/messages.xml — the authentication bypass occurs because Ametys only enforces auth when the URI contains /cms/ ↗
• → Detect POST requests to /plugins/core-ui/servercomm/messages.xml containing 'users/search.json' in the body, indicating unauthenticated user enumeration ↗
• → Alert on requests to /plugins/core-ui/servercomm/messages.xml that do NOT contain /cms/ in the URI path, as this is the bypass vector ↗

• · The exploit uses a Referer header pointing to /cms/www/index.html while the actual malicious request bypasses /cms/ auth — WAF rules matching only on Referer or URI prefix /cms/ will miss this attack ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20