cbcvebase.
CVE-2022-26833
published 2022-05-25

CVE-2022-26833: An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series…

PriorityP188critical9.4CVSS 3.1
AVNACLPRNUINSUCLIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
37.61%
98.3th percentile
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.

Affected

2 ranges
VendorProductVersion rangeFixed in
open_automation_softwareoas_platform
openautomationsoftwareoas_platform

Detection & IOCsextracted from sources · hover to see the quote

url/OASREST/v2/authenticate
commandPOST /OASREST/v2/authenticate HTTP/1.1 Host: {{Hostname}} Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive Content-Type: application/json {"username": "", "password": ""}
  • Detect unauthenticated REST API authentication bypass by looking for POST requests to /OASREST/v2/authenticate with empty username and password credentials returning HTTP 200 with a valid token and clientid in the JSON response body.
  • A successful exploit response will contain all four fields in the JSON body: 'status', 'data', 'token', and 'clientid', with Content-Type: application/json header and HTTP 200 status.
  • The exploit payload uses an empty username and password JSON body: {"username": "", "password": ""} sent to the OAS Platform REST API endpoint.
  • ·Vulnerability affects specifically OAS Platform version V16.00.0121; the CPE references build 16.00.0112, indicating the version range may span multiple minor builds.
  • ·The vulnerability requires a specially-crafted *series* of HTTP requests, not necessarily a single request, to trigger unauthenticated REST API access.

CVSS provenance

nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.4CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.