NN-2020:2-01

Cross-site request forgery attack on change password form

Last update: 2020-05-26

Advisory IDNN-2020:2-01
TopicCross-site request forgery attack on change password form
ImpactCSRF
Issue date2020-05-26
AffectsN2OS between v19.0.4 and v20.0.3, Guardian and CMC
CVE Name(s)NA
CVSS Score8.8
CVE Risk LevelHigh
Risk Level for Nozomi customersMedium

Summary

Change password doesn't validate CSRF token properly.

Impact

An attacker can force the victim to change password without knowing. To successfully complete this attack the victim needs to be logged to the Guardian/CMC and visit a special prepared page containing the forged change password request. The change password request will be logged to the internal Guardian/CMC audit log and the victim session will be terminated. The attacked must have Guardian/CMC reachability to login into the system after a successful attack.

Affected Products

Guardian/CMC starting from v19.0.4 are affected, versions before v19.0.4 are NOT affected.

Workarounds and Mitigations

Users should always pay attention to phishing emails and un-trusted links.

Solutions

v19 series: Upgrade to v19.0.11 v20 series: Upgrade to v20.0.3

Modification History

2020-05-26: Initial revision

Related Links

None

Acknowledgements

This bug was found by Schneider Electric Industry Services

Contact

Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com. More contact details on the PSIRT page.