""We have released [Passwordstate] build 9972," Click Studio's support team posted to the company's announcements board, "which includes two security updates. We recommend customers upgrade as soon as possible.""
""Creating "a carefully crafted URL" allows attackers to access the Passwordstate Emergency Access portal, which is designed to provide ingress into the software when other accounts have been locked out or are otherwise inaccessible. "This account doesn't allocate a license from your available license pool," the company's documentation explains, "and is not intended for use in day to day operations. It should be regarded as an account of last resort."""
""For attackers, though, it seems to be very much an account of first resort. With nothing more than the "carefully crafted URL" and a web browser, attackers can bypass the authentication requirement of the Emergency Access portal - giving full administrator-level access to the Passwordstate installation, albeit at the cost of triggering email alerts to all registered security administrators on the system.""
A serious authentication bypass exists in Passwordstate's Emergency Access portal that allows attackers to gain administrator-level access using a carefully crafted URL and a web browser. The Emergency Access account is intended only as a last-resort entry and does not allocate a license from the available license pool. Exploitation triggers email alerts to registered security administrators but still grants full administrative control. Click Studios released build 9972 containing two security updates: mitigation for clickjacking against the browser extension and a fix for the potential authentication bypass, with a CVE pending. Immediate upgrades are recommended.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]