ekcrsm/cve-2024-23733Proof-of-concept exploit for CVE-2024-23733: Incorrect Access Control in Software AG webMethods Integration Server 10.15.0 allowing remote attackers to access the admin panel and discover hostname and version information.
CVE-2024-23733 Software AG webMethods API Integration Server 10.15.0 Incorrect Access Control
Description The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
Vulnerability Type Incorrect Access Control
Vendor of Product SoftwareAG
Affected Product Code Basehttps://github.com/ekcrsm/CVE-2024-23733/tree/main WebMethods Integration Server - It is tested on 10.15.0.0000-0092.Got fixed in IS_10.15 Core_Fix7
Affected Component Software AG webMethods API Integration Server 10.15.0
Attack Type Remote
Impact Information Disclosure True
Affected Component /WmAdmin/,/invoke/vm.server/login ( Login Page)
Attack Vectors To exploit the vulnerability, should interpret the http traffic and sending a dummy username(e.g asteriks) with blank password on login screen( through /invoke/vm.server/login call) allows to reach the administrative dashboard. /admin/navigation/license request should be dropped to not logged out. The real hostname of the server which the product installed on,the version information and any administrative api endpoints are getting visible.
Reference https://www.softwareag.com/en_corporate/platform/integration-apis/webmethods-integration.html
Discoverer Rasime Ekici
