CVE-2022-47002
published 2023-02-01CVE-2022-47002: A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
6.25%
92.7th percentile
A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| masacms | masacms | < 7.2.5 | 7.2.5 |
| masacms | masacms | — | — |
| masacms | masacms | >= 7.3 < 7.3.10 | 7.3.10 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends a GET request to /admin/?muraAction=cEditProfile.edit with a crafted Cookie header containing 'userid=<UUID>' and an empty 'userhash=' value to bypass authentication via the Remember Me function. ↗
- →The attacker first harvests a valid admin UUID by querying the unauthenticated JSON API endpoint /index.cfm/_api/json/v1/<siteid>/content/?fields=lastupdatebyid and extracting the 'lastupdatebyid' field matching regex '"lastupdatebyid":"([A-F0-9-]+)"'. ↗
- →The site ID required for the API call can be extracted from the CMS homepage using the regex 'siteid:"(.*?)"'. ↗
- →Shodan queries 'Generator: Masa CMS' and 'generator: masa cms' can be used to identify internet-exposed Masa CMS instances potentially vulnerable to this CVE. ↗
- ·The vulnerability affects Masa CMS versions 7.2, 7.3, and 7.4-beta only. Version 7.3.10 and later contain the fix. ↗
- ·The exploit is a three-step chained request: (1) fetch homepage to extract siteid, (2) call unauthenticated JSON API to harvest an admin UUID, (3) replay UUID in the Remember Me cookie with an empty userhash to gain admin access. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Masa CMS - Authentication Bypass
nuclei·CVSS 9.8
CVE-2022-47002 [CRITICAL] Masa CMS - Authentication Bypass
Masa CMS - Authentication Bypass
Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
Template:
id: CVE-2022-47002
info:
name: Masa CMS - Authentication Bypass
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affect
No writeups or analysis indexed.
https://github.com/MasaCMS/MasaCMS/releases/tag/7.3.10https://www.hoyahaxa.com/2023/01/preliminary-security-advisory.htmlhttps://www.hoyahaxa.com/2023/03/authentication-bypass-mura-masa.htmlhttps://github.com/MasaCMS/MasaCMS/releases/tag/7.3.10https://www.hoyahaxa.com/2023/01/preliminary-security-advisory.htmlhttps://www.hoyahaxa.com/2023/03/authentication-bypass-mura-masa.html
2023-02-01
Published